VertiGIS WebOrderSystem through 7.0.8.6 has multiple XSS flaws
SEC Consult lists CVE-2026-4950, CVE-2026-4951 and CVE-2026-4952; the fixed version is unknown.
48
CVE-2026-4952
Stored XSS in VertiGIS WebOrderSystem OrderAdministration
- CVSS 4.0
- 5.1 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Authenticated users in VertiGIS ASMobile can inject JavaScript into business reference fields. The code is stored in order details and executed in OrderAdministration portal when a highly privileged user opens the order. Attackers gain arbitrary script execution with admin rights. Affects VertiGIS WebOrderSystem version 7.0.8.6.
What to do: Upgrade VertiGIS WebOrderSystem to a fixed version. No workaround known.
| Product | Affected |
|---|---|
| VertiGIS WebOrderSystem | 7.0.8.6 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
- Weakness
- CWE-79
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X