Reflected XSS Vulnerability in WEBCON BPS by WEBCON

CVE-2026-1630

What is CVE-2026-1630?

WEBCON BPS is exposed to a reflected cross-site scripting vulnerability due to improper handling of input passed through the '/openinmobileapp' endpoint. An attacker can craft a malicious URL that executes arbitrary JavaScript when accessed by an authenticated user. This can lead to various forms of exploitation, including data theft and session hijacking. Users are encouraged to update to versions 2026.1.3.109 or 2025.2.1.293 to mitigate this risk.

References