WEBCON

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

WEBCON records in CISA KEV

No WEBCON vulnerabilities are listed in CISA KEV.

2 records

TI-2026-62331 CVE-2026-92419 · GHSA-q2c4-mww2-9fhw

LOW 24

WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00423 Published 2026-09-23 Fixed in 2025.2.1.177, 2026.1.1.20 CWE-639

TI-2026-01316 CVE-2026-1630 · GHSA-r6h3-9v4w-m3wg

LOW 24

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0043 Published 2026-05-14 Fixed in 2026.1.3.109, 2025.2.1.293 CWE-79