Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.1 | CVE-2026-4952 |
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference
VertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (AuftragsManager), VertiGIS Ltd. WebOrderSystem, VertiGIS Ltd. GIS Portal, VertiGIS Ltd. ASMobile, VertiGIS Ltd. KundenManager, VertiGIS Ltd. AuftragsManager
|
NVD | |||
|
CVE-2026-4952The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference
Executive summaryThe advisory describes multiple cross-site scripting flaws in VertiGIS WebOrderSystem, including its KundenManager customer administration portal and AuftragsManager order administration portal, plus a stored flaw in the ASMobile web interface of GIS Portal. An attacker could run malicious JavaScript in a victim's browser, and the advisory rates the impact as medium. The vendor has not released a patch or fixed version and says fixes will come with the LM Explorer product, so the advisory recommends contacting the vendor and applying the workaround for CVE-2026-4952 in the meantime. Technical summaryThe issues are cross-site scripting (XSS): one stored XSS in the KundenManager secondName parameter (CVE-2026-4950), one reflected XSS in the KundenManager searchValue parameter that requires a logged-in privileged user to visit a crafted URL (CVE-2026-4951), and one stored XSS in the ASMobile business reference that is later rendered in the AuftragsManager order view (CVE-2026-4952). The stored issues need an authenticated user, and the reflected issue needs a privileged user to be logged in and click a link. The advisory states the vulnerable version as <=7.0.8.6 and the fixed version as unknown, and it states that no version numbers were provided for fixes. A workaround for CVE-2026-4952 is an optional regular expression on the business reference for input validation, while the advisory lists no workaround for CVE-2026-4950 or CVE-2026-4951. No patch, detection guidance, or exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from r.sec-consult.com/vertigis Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsVertiGIS Ltd.VertiGIS Ltd. WebOrderSystem (AuftragsManager)VertiGIS Ltd. WebOrderSystemVertiGIS Ltd. GIS PortalVertiGIS Ltd. ASMobileVertiGIS Ltd. KundenManagerVertiGIS Ltd. AuftragsManager
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||