CVE-2026-4951

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...

CVE-2026-4950

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...

CVE-2026-4951

The VertiGIS WebOrderSystem CustomerAdministration portal (KundenManager ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists because the application fails to properly neutralize input in the "searchValue" URL parameter, allowing an unauthenticated attacker to execute arbitra...

EUVD-2026-108613

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...

CVE-2026-4950

The VertiGIS WebOrderSystem is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in its CustomerAdministration portal (KundenManager) . The issue occurs because user properties, such as the "secondName" parameter , can be populated with malicious JavaScript code during user editing. This cod...

EUVD-2026-108612

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...