CVE-2026-4950: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in VertiGIS Ltd. WebOrderSystem (KundenManager)

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem suffers from an improper neutralization of input during web page generation (CWE-79), allowing stored cross-site scripting. Privileged users can insert JavaScript code into editable user properties such as "secondName". When other privileged users view these entries, the malicious script executes in their browsers, potentially compromising their sessions. The vulnerability affects versions >=0 and <=7.0.8.6. The vendor has not disclosed any patch or fixed versions at the time of reporting.

An authenticated attacker with privileged access to the portal can inject malicious scripts that execute in the browsers of other privileged users. This can lead to session hijacking or unauthorized actions within the portal under the victim's session. The CVSS 4.8 score reflects a medium severity with network attack vector, low attack complexity, and no user interaction required beyond viewing the malicious entry. There is no indication of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileged user access to trusted personnel only and consider monitoring for suspicious input in user properties. Avoid opening or viewing user entries from untrusted sources. No official fix or workaround has been provided by the vendor at this time.