CVE-2026-4952 Details
Description
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
A stored cross-site scripting vulnerability has been identified in the VertiGIS WebOrderSystem, specifically within the OrderAdministration portal. This issue arises from the 'ASMobile' web interface, which is part of the VertiGIS GIS Portal software package. Authenticated users can inject JavaScript code into a business reference field. While this initially constitutes a self-XSS vulnerability, the injected code is executed when a highly privileged user accesses the order details in the OrderAdministration portal. This vulnerability affects VertiGIS WebOrderSystem version 7.0.8.6.
While no official patch is available, the vendor has indicated that the vulnerabilities will be addressed in a future release of 'LM Explorer', the successor to '3A Web'. In the meantime, a workaround exists by defining an optional regular expression for the business reference, which can serve as an input validation measure against cross-site scripting.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://r.sec-consult.com/vertigis | SEC Consult Vulnerability Lab | AdvisoryBundleExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | SEC Consult Vulnerability Lab |
Affected Products
| Product | Versions |
|---|---|
| VertiGIS ASMobile | All versions |
CPE
Remediation
| |
| VertiGIS WebOrderSystem | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | SEC Consult Vulnerability Lab |