Multiple cross-site scripting vulnerabilities in VertiGIS WebOrderSystem (KundenManager, AuftragsManager)

The WebOrderSystem by VertiGIS is affected by multiple cross-site scripting (XSS) vulnerabilities. This allows an attacker to execute malicious JavaScript code in the victim's browser. The vendor did not communicate a patch for the identified vulnerabilities in VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the fixes. Version numbers were not provided nor when the fixes were implemented. A workaround exists for CVE-2026-4952, which should be applied while no official fix is available. Contact the vendor for further information regarding fixes or hardening measures.
 

CVE-2026-4950, CVE-2026-4951, CVE-2026-4952
 

Read the full advisory here (opens in a new tab)