38 matches found
CVE-2026-4951
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
CVE-2026-4950
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
CVE-2026-4952
The VertiGIS WebOrderSystem (specifically version 7.0.8.6 and potentially others) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the "ASMobile" web interface of the "GIS Portal" package, where authenticated users can input JavaScript into a business reference field. While...
CVE-2026-4952 Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...
CVE-2026-4951 Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
EUVD-2026-108613
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
CVE-2026-4951
The VertiGIS WebOrderSystem CustomerAdministration portal (KundenManager ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists because the application fails to properly neutralize input in the "searchValue" URL parameter, allowing an unauthenticated attacker to execute arbitra...
CVE-2026-4950
The VertiGIS WebOrderSystem is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in its CustomerAdministration portal (KundenManager) . The issue occurs because user properties, such as the "secondName" parameter , can be populated with malicious JavaScript code during user editing. This cod...
CVE-2026-4950 Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
EUVD-2026-108612
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
PT-2026-121785
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...
VertiGIS WebOrderSystem 7.0.8.6 Cross Site Scripting
VertiGIS WebOrderSystem version 7.0.8.6 and earlier contains stored and reflected cross site scripting vulnerabilities in its CustomerAdministration and OrderAdministration portals. SEC Consult Vulnerability Lab Security Advisory...
PT-2026-121784
The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...
VertiGIS - Detect
VertiGIS products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VertiGIS products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VertiGIS - Detect', 'description': 'VertiGIS products was...
CVE-2026-3877
A reflected cross-site scripting XSS vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered...
CVE-2026-0522
A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...
EUVD-2026-17883
A reflected cross-site scripting XSS vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered...
CVE-2026-3877
A reflected cross-site scripting XSS vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered...
CVE-2026-3877 Reflected Cross-Site Scripting in Dashboard Search
A reflected cross-site scripting XSS vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered...
CVE-2026-3877
The CVE-2026-3877 issue affects the VertiGIS FM dashboard search. It is a reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality that can be triggered when an authenticated user visits a crafted URL, leading to arbitrary JavaScript execution in the user’s browser...