WebSystems WebTOTUM Cross-Site Scripting Vulnerability in Calendar Component

A cross-site scripting (XSS) vulnerability has been identified in WebSystems WebTOTUM version 2026. This issue affects the Calendar component, where an unknown function can be manipulated to inject web scripts or arbitrary HTML. The injected payload is stored on the server and executed in the context of other users' browsers when they access the affected page. This vulnerability arises from inadequate validation or escaping of user-supplied input, potentially allowing attackers to compromise user sessions or perform unauthorized actions. The vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users are advised to upgrade to the latest version of WebSystems WebTOTUM. The fixed version is available for download on the WebSystems website.