CVE-2026-4952

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.

• CWE-79

• https://r.sec-consult.com/vertigis

Published

Oct 23, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49501Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and…6.7
• CVE-2026-49502Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…8.1
• CVE-2026-49506Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, c…7.2
• CVE-2026-49509Out-of-bounds read vulnerability in Samsung Opensource rLott…4.4
• CVE-2026-4951The CustomerAdministration portal (KundenManager) of VertiGI…5.1
• CVE-2026-49510Integer overflow or wraparound vulnerability in Samsung Open…6.1
• CVE-2026-4953A weakness has been identified in mingSoft MCMS up to 5.5.0.…7.3
• CVE-2026-4954A security vulnerability has been detected in mingSoft MCMS …6.3
• CVE-2026-4955A vulnerability was found in Shenzhen Ruiming Technology Str…7.3
• CVE-2026-4956A vulnerability was detected in Shenzhen Ruiming Technology …7.3
• CVE-2026-4957A flaw has been found in OpenBMB XAgent 1.0.0. The impacted …2.7
• CVE-2026-4958A vulnerability has been found in OpenBMB XAgent 1.0.0. This…6.5