CVE-2026-6743 - WebSystems WebTOTUM Calendar cross site scripting

Back Back to CVE browser

MEDIUM

WebSystems WebTOTUM Calendar cross site scripting

Published Apr 21, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.33%

Description

A vulnerability has been found in WebSystems WebTOTUM 2026. This impacts an unknown function of the component Calendar. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected products

Vendor WebSystems Product WebTOTUM Default
n/a
- Version
  2026
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WebSystems

WebTOTUM

n/a

Version	Status	Constraints
2026	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (5)

https://olografix.org/acme/WebTOTUM-POC.gif
exploit
https://vuldb.com/submit/794617
third-party-advisory
https://vuldb.com/vuln/358434
vdb-entry
https://vuldb.com/vuln/358434/cti
signaturepermissions-required
https://www.websys.eu/gestionale-online-in-cloud-per-pmi-callcenter
patch

Link	Providers	Tags
https://olografix.org/acme/WebTOTUM-POC.gif		exploit
https://vuldb.com/submit/794617		third-party-advisory
https://vuldb.com/vuln/358434		vdb-entry
https://vuldb.com/vuln/358434/cti		signaturepermissions-required
https://www.websys.eu/gestionale-online-in-cloud-per-pmi-callcenter		patch