VertiGIS WebOrderSystem through 7.0.8.6 has multiple XSS flaws
Original title: SEC Consult SA-20261023-0 :: Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem
SEC Consult lists CVE-2026-4950, CVE-2026-4951 and CVE-2026-4952; the fixed version is unknown.
SEC Consult Vulnerability Lab reported multiple cross-site scripting flaws in VertiGIS WebOrderSystem, covering KundenManager and AuftragsManager. Versions through 7.0.8.6 are vulnerable. The advisory says the fixed version is unknown and assigns CVE-2026-4950, CVE-2026-4951 and CVE-2026-4952.
Unconfirmed: The fixed version is unknown in the advisory snippet.
- Vulnerable versions are <=7.0.8.6.
- The advisory states the fixed version is unknown.
- Products named are KundenManager and AuftragsManager.
- Posted on Full Disclosure on October 27.
Impact: Cross-site scripting in the web order system
| Product | Affected |
|---|---|
| VertiGIS WebOrderSystem | <=7.0.8.6 |
- Vendors
- VertiGIS
- Organizations
- SEC Consult Vulnerability Lab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-4952+1 related CVE | Stored XSS in VertiGIS WebOrderSystem OrderAdministration | 5.1 group max | — | ||
| CVE-2026-4951 | Reflected XSS in VertiGIS WebOrderSystem KundenManager | 5.1 | — |
From the original article
Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 27 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: VertiGIS WebOrderSystem (KundenManager, AuftragsManager) vulnerable version: <=7. 0. 8.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.