Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.1 | CVE-2026-4952 |
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference
VertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (AuftragsManager), VertiGIS Ltd. WebOrderSystem, VertiGIS Ltd. GIS Portal, VertiGIS Ltd. ASMobile, VertiGIS Ltd. KundenManager, VertiGIS Ltd. AuftragsManager
|
NVD | |||
|
CVE-2026-4952The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference
Executive summaryThe advisory describes multiple cross-site scripting flaws in VertiGIS WebOrderSystem, including its KundenManager customer administration portal and AuftragsManager order administration portal, plus a stored flaw in the ASMobile web interface of GIS Portal. An attacker could run malicious JavaScript in a victim's browser, and the advisory rates the impact as medium. The vendor has not released a patch or fixed version and says fixes will come with the LM Explorer product, so the advisory recommends contacting the vendor and applying the workaround for CVE-2026-4952 in the meantime. Technical summaryThe issues are cross-site scripting (XSS): one stored XSS in the KundenManager secondName parameter (CVE-2026-4950), one reflected XSS in the KundenManager searchValue parameter that requires a logged-in privileged user to visit a crafted URL (CVE-2026-4951), and one stored XSS in the ASMobile business reference that is later rendered in the AuftragsManager order view (CVE-2026-4952). The stored issues need an authenticated user, and the reflected issue needs a privileged user to be logged in and click a link. The advisory states the vulnerable version as <=7.0.8.6 and the fixed version as unknown, and it states that no version numbers were provided for fixes. A workaround for CVE-2026-4952 is an optional regular expression on the business reference for input validation, while the advisory lists no workaround for CVE-2026-4950 or CVE-2026-4951. No patch, detection guidance, or exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from r.sec-consult.com/vertigis Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsVertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (AuftragsManager)VertiGIS Ltd. WebOrderSystemVertiGIS Ltd. GIS PortalVertiGIS Ltd. ASMobileVertiGIS Ltd. KundenManagerVertiGIS Ltd. AuftragsManager
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-4951 |
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups)
VertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (KundenManager), VertiGIS Ltd. WebOrderSystem, VertiGIS Ltd. KundenManager, VertiGIS Ltd. AuftragsManager
|
NVD | |||
|
CVE-2026-4951The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups)
Executive summaryThe advisory describes cross-site scripting flaws in VertiGIS WebOrderSystem, including its CustomerAdministration portal (KundenManager) and OrderAdministration portal (AuftragsManager), affecting version 7.0.8.6 and earlier. The advisory rates the impact as medium, and the vendor has not published a patch, saying fixes will come with the LM Explorer product. The vendor recommends restricting portal access to the intranet and following its product announcements, and the advisory notes that a workaround exists for only one of the three flaws. Technical summaryCVE-2026-4951 is a reflected cross-site scripting flaw in the CustomerAdministration portal, where the search parameter "searchValue" is reflected into a URL and executed in the browser of a logged-in privileged user who visits a crafted link. The advisory states the attacker is unauthenticated but needs knowledge of the URL structure, and the victim must already be logged in. The vulnerable version is listed as <=7.0.8.6 and the fixed version is stated as unknown, with no version numbers or fix dates provided. The workaround for this CVE is stated as None, and the advisory gives no detection guidance or CVSS score. Related flaws CVE-2026-4950 and CVE-2026-4952 are also described in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from r.sec-consult.com/vertigis Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsVertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (KundenManager)VertiGIS Ltd. WebOrderSystemVertiGIS Ltd. KundenManagerVertiGIS Ltd. AuftragsManager
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.8 | CVE-2026-4950 |
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups)
VertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (KundenManager), VertiGIS Ltd. WebOrderSystem, VertiGIS Ltd. KundenManager, VertiGIS Ltd. AuftragsManager
|
NVD | |||
|
CVE-2026-4950The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups)
Executive summaryVertiGIS WebOrderSystem, including its CustomerAdministration (KundenManager) and OrderAdministration (AuftragsManager) portals, contains three cross-site scripting flaws that let attackers run malicious JavaScript in the browsers of other users. The advisory describes the severity as medium, and the vendor considers the instances non-critical, but it has not provided a patch or a fixed version and says fixes will come with the LM Explorer product. Technical summaryThe advisory describes stored XSS in the CustomerAdministration portal (CVE-2026-4950) via the secondName parameter when editing a user, reflected XSS in that portal (CVE-2026-4951) via the searchValue URL parameter, and stored XSS in the OrderAdministration portal (CVE-2026-4952) via a business reference entered in the ASMobile interface. Exploitation requires an authenticated attacker for the stored issues and a logged-in privileged user visiting a crafted URL for the reflected issue. The vulnerable version is stated as <=7.0.8.6 and the fixed version is listed as unknown. A workaround is stated only for CVE-2026-4952, namely an optional regular expression on the business reference for input validation; the advisory states none for CVE-2026-4950 and CVE-2026-4951. No detection guidance is stated, and no CVSS score is given beyond the impact rating of medium. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from r.sec-consult.com/vertigis Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsVertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (KundenManager)VertiGIS Ltd. WebOrderSystemVertiGIS Ltd. KundenManagerVertiGIS Ltd. AuftragsManager
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||