WEBCON CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM WEBCON CVE published 2026-05-14

CVE-2026-1630

PatchSiren debrief for CVE-2026-1630: WEBCON BPS is vulnerable to Reflected XSS via the /openinmobileapp endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293. The vulnerability requires prompt attention from IT administrators, secur [truncated]