CVE-2026-4951: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in VertiGIS Ltd. WebOrderSystem (KundenManager)

The vulnerability in VertiGIS WebOrderSystem (KundenManager) involves improper neutralization of input during web page generation (CWE-79). Specifically, the "searchValue" URL parameter is not properly sanitized, allowing JavaScript injection. An unauthenticated attacker can craft a URL containing malicious script code. When a privileged user opens this URL, the script executes in their browser context. Because privileged users can change other users' passwords without authentication of the old password, this XSS can be leveraged to hijack accounts or lock out users. The affected versions include all versions up to and including 7.0.8.6. There is no vendor-provided patch or advisory detailing remediation steps at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a privileged user’s browser session. This can lead to account takeover or denial of service by locking out users, including administrators, due to the ability of privileged users to change passwords without old password verification. The vulnerability impacts confidentiality and availability of user accounts within the WebOrderSystem portal.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or suspicious URLs containing the "searchValue" parameter. Privileged users should be cautious about links received from untrusted sources. Consider implementing additional access controls or input validation on the server side if possible.