CVE-2026-107396

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.13

Description Users with permissions to manage events or create content, such as speakers uploading materials, can store crafted JavaScript URLs in fields that accept custom URLs. A user who follows one of these URLs may trigger the execution of an attacker-controlled script within their browser in the Indico origin. This is a stored cross-site scripting issue where malicious scripts are permanently stored on the server and served to other users.

Recommendations Update to version 3.3.13.