Threat database

CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. This code executes when a privileged user views the order in the OrderAdministration portal, potentially leading to privilege escalation or session compromise. The vulnerability has a medium severity score of 5.1 and affects versions up to 7.0.8.6. No patch or remediation information is provided by the vendor.

CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem. It allows an attacker to inject JavaScript code via the "searchValue" URL parameter, which executes in the browser of a privileged user who opens a crafted link. This can lead to account takeover or user lockout since administrative users can change passwords without needing the old password. Version 7.0.8.6 and earlier versions are affected. The vulnerability has a medium severity score of 5.1. No patch or remediation information is currently available from the vendor.

CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This code is stored and executed in the browsers of other privileged users viewing the affected user entries or user group overviews. The vulnerability affects versions from 0 up to and including 7.0.8.6. It requires authenticated access with high privileges and user interaction to trigger. No patch or remediation information is provided by the vendor.