WebOrderSystem Vulnerability in VertiGIS Affects Privileged User Accounts
CVE-2026-4951

5.1MEDIUM

Key Information:

Vendor

Vertigis Ltd.

Status
Webordersystem (kundenmanager)
Vendor
CVE Published:
23 October 2026

What is CVE-2026-4951?

The CustomerAdministration portal of VertiGIS WebOrderSystem poses a security risk by allowing privileged users to inadvertently execute malicious scripts. This vulnerability arises when an attacker crafts a URL with JavaScript commands, which is then executed in the browser of a logged-in user. Given that administrative users can modify passwords without prior verification, this flaw can potentially allow unauthorized account access or lockouts for other users.

Affected Version(s)

WebOrderSystem (KundenManager) 0 <= 7.0.8.6

References

https://r.sec-consult.com/vertigis
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

K. Zimmermann, SEC Consult Vulnerability Lab
.