Self-XSS Security Flaw in VertiGIS GIS Portal Affects WebOrderSystem
CVE-2026-4952

5.1MEDIUM

Key Information:

Vendor

Vertigis Ltd.

Status
Webordersystem (auftragsmanager)
Vendor
CVE Published:
23 October 2026

What is CVE-2026-4952?

The VertiGIS GIS Portal's web interface, 'ASMobile', permits authenticated users to insert JavaScript code into a customizable business reference field. While this initially results in a self-XSS vulnerability affecting only the user, it becomes a more serious issue when this business reference is included in order details. When a privileged user accesses the order through the VertiGIS WebOrderSystem's OrderAdministration portal, the stored JavaScript code executes, potentially leading to unauthorized access and manipulation of sensitive information.

Affected Version(s)

WebOrderSystem (AuftragsManager) 0 <= 7.0.8.6

References

https://r.sec-consult.com/vertigis
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

K. Zimmermann, SEC Consult Vulnerability Lab
.