A stored cross-site scripting vulnerability exists in the OrderAdministration Portal (AuftragsManager) of VertiGIS WebOrderSystem. Authenticated users can insert JavaScript code into the business reference field, which is then executed when a highly privileged user views the order details. This vulnerability requires verification of exposure, especially for systems with highly privileged users, and priori [truncated]
CVE-2026-4951 is a reflected cross-site scripting vulnerability in the CustomerAdministration portal of VertiGIS WebOrderSystem. An unauthenticated attacker can craft a link containing script code that runs in a privileged user's browser, potentially allowing account takeover or user lockout. The vulnerability exists in version 7.0.8.6 and potentially other versions. Defenders should assess exposure, espe [truncated]
CVE-2026-4950 is a stored cross-site scripting vulnerability in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem. Privileged users can inject JavaScript code into user properties, which is then executed in the browser of other privileged users who access the edited user entry or user overview. This issue affects version 7.0.8.6 and potentially other versions, but the vendor did [truncated]
