JavaScript Injection Vulnerability in VertiGIS WebOrderSystem CustomerAdministration Portal
CVE-2026-4950

4.8MEDIUM

Key Information:

Vendor

Vertigis Ltd.

Status
Webordersystem (kundenmanager)
Vendor
CVE Published:
23 October 2026

What is CVE-2026-4950?

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem is susceptible to a JavaScript injection vulnerability. This issue arises when privileged users are allowed to modify user properties, such as the 'secondName' parameter, with JavaScript code. When a user edits these properties, the injected code is stored and later executed in the browser of any other privileged user accessing the modified user details or the user group overview. This flaw can be exploited by an authenticated attacker with access to the portal, facilitating unauthorized script execution in the sessions of other users.

Affected Version(s)

WebOrderSystem (KundenManager) 0 <= 7.0.8.6

References

https://r.sec-consult.com/vertigis
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

K. Zimmermann, SEC Consult Vulnerability Lab
.