19 matches found
CVE-2026-4951
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
CVE-2026-4950
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
CVE-2026-4952 Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...
CVE-2026-4952 Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...
CVE-2026-4952
The VertiGIS WebOrderSystem (specifically version 7.0.8.6 and potentially others) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the "ASMobile" web interface of the "GIS Portal" package, where authenticated users can input JavaScript into a business reference field. While...
EUVD-2026-108613
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
CVE-2026-4951 Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
CVE-2026-4951 Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
CVE-2026-4951
The VertiGIS WebOrderSystem CustomerAdministration portal (KundenManager ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists because the application fails to properly neutralize input in the "searchValue" URL parameter, allowing an unauthenticated attacker to execute arbitra...
EUVD-2026-108612
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
CVE-2026-4950
The VertiGIS WebOrderSystem is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in its CustomerAdministration portal (KundenManager) . The issue occurs because user properties, such as the "secondName" parameter , can be populated with malicious JavaScript code during user editing. This cod...
CVE-2026-4950 Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
CVE-2026-4950 Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
VertiGIS WebOrderSystem 7.0.8.6 Cross Site Scripting
VertiGIS WebOrderSystem version 7.0.8.6 and earlier contains stored and reflected cross site scripting vulnerabilities in its CustomerAdministration and OrderAdministration portals. SEC Consult Vulnerability Lab Security Advisory...
VertiGIS WebOrderSystem cross-site scripting vulnerability
VertiGIS WebOrderSystem versions 7.0.8.6 and earlier contain a cross-site scripting vulnerability. This vulnerability arises because business reference fields in the ASMobile web interface allow authenticated users to insert JavaScript code. Such code is stored alongside order details and execute...
PT-2026-121784
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
VertiGIS WebOrderSystem cross-site scripting vulnerability
VertiGIS WebOrderSystem versions 7.0.8.6 and earlier contain a cross-site scripting vulnerability. This vulnerability arises from the failure to sanitize JavaScript code within user attributes such as secondName when editing users. The stored code executes in the browser of other privileged users...
PT-2026-121785
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
VertiGIS WebOrderSystem cross-site scripting vulnerability
VertiGIS WebOrderSystem versions 7.0.8.6 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient sanitization of the searchValue URL parameter. Attackers can craft links containing JavaScript code that executes when accessed by authenticated privileged users,...