TI-2026-79577 Aliases CVE-2026-4950 GHSA-g5vv-w6m9-qrh6

Stored cross-site scripting in VertiGIS WebOrderSystem KundenManager

LOW 22CWE-79Published 2026-10-23 · Updated 2026-10-28

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

VertiGIS WebOrderSystem (KundenManager) from 0 through 7.0.8.6 is affected. The CustomerAdministration portal does not neutralize JavaScript entered in user properties such as the secondName parameter, so the stored script runs in the browser of other privileged users who open the edited user or the user group overview (CWE-79). An authenticated attacker with access to the portal can run script code in the sessions of other portal users.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00309 23rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VertiGIS Ltd.	WebOrderSystem (KundenManager)	up to 7.0.8.6	—	No fix listed	CNA

WebOrderSystem (KundenManager) VendorVertiGIS Ltd. Affected up to 7.0.8.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for VertiGIS WebOrderSystem (KundenManager).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-23 Threatist record created from CVE-2026-4950
2026-10-23 Alias added: GHSA-g5vv-w6m9-qrh6
2026-10-28 CISA SSVC decision points changed

References

Advisory 1

https://r.sec-consult.com/vertigis

TI-2026-00330 Local File Inclusion in the File Upload/Download Process CVSS 4.0HIGH 7.4
TI-2026-03356 Reflected Cross-Site Scripting in Dashboard Search CVSS 4.0HIGH 7.3
TI-2021-08867 VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows… CVSS 3.1HIGH 7.5
TI-2026-79579 Stored XSS in VertiGIS WebOrderSystem (AuftragsManager) via Business Reference CVSS 4.0MEDIUM 5.1
TI-2026-79578 Reflected XSS in VertiGIS WebOrderSystem CustomerAdministration Portal CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences