---
id: "CVE-2026-4951"
kind: "vulnerability"
aliases: ["CVE-2026-4951"]
title: "VertiGIS WebOrderSystem: reflected script injection in admin portal search"
severity: "medium"
cvss: 5.1
epss: 0.00362
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["customer-administration", "self-hosted", "vendor", "vertigis", "webordersystem"]
not_affected_if: ["no-customer-administration-portal"]
published_at: "2026-10-23T08:16:55+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:28:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4951", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-4951", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# VertiGIS WebOrderSystem: reflected script injection in admin portal search

The CustomerAdministration portal of VertiGIS WebOrderSystem reflects the searchValue URL parameter without sanitizing it, so script in a crafted link runs in the browser of a logged-in privileged user. An attacker who gets such a user to open the link can act as that user, including changing other users' passwords without the old password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the CustomerAdministration (KundenManager) portal of WebOrderSystem is deployed, for example by its URL path
- Confirm the installed version; the sources report 7.0.8.6 as affected and say nothing about other versions
- Check with the vendor whether a fixed version exists

## Fix

- unknown: the sources state the vendor provided no information about further affected versions or a fix
- Until a fix is available, restrict access to the portal and warn privileged users not to open links from untrusted sources

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-4951
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-4951

## From the sources

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL. JavaScript code placed in this parameter is executed in the victim's browser. An unauthenticated attacker who knows the URL structure can craft a link that contains script code. The code runs if a privileged user who is currently logged into the portal opens the link. Because administrative users can change the passwords of other users, including administrators, without entering the old password, an attacker may be able to take over accounts or lock out other users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_