CVE-2026-4951

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL. JavaScript code placed in this parameter is executed in the victim's browser. An unauthenticated attacker who knows the URL structure can craft a link that contains script code. The code runs if a privileged user who is currently logged into the portal opens the link. Because administrative users can change the passwords of other users, including administrators, without entering the old password, an attacker may be able to take over accounts or lock out other users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.

• CWE-79

• https://r.sec-consult.com/vertigis

Published

Oct 23, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4950The CustomerAdministration portal (KundenManager) of VertiGI…4.8
• CVE-2026-49500Dell Alienware Command Center (AWCC), versions prior to 6.14…6
• CVE-2026-49501Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and…6.7
• CVE-2026-49502Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…8.1
• CVE-2026-49506Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, c…7.2
• CVE-2026-49509Out-of-bounds read vulnerability in Samsung Opensource rLott…4.4
• CVE-2026-49510Integer overflow or wraparound vulnerability in Samsung Open…6.1
• CVE-2026-4952The "ASMobile" web interface, which is part of the VertiGIS …5.1
• CVE-2026-4953A weakness has been identified in mingSoft MCMS up to 5.5.0.…7.3
• CVE-2026-4954A security vulnerability has been detected in mingSoft MCMS …6.3
• CVE-2026-4955A vulnerability was found in Shenzhen Ruiming Technology Str…7.3
• CVE-2026-4956A vulnerability was detected in Shenzhen Ruiming Technology …7.3