VertiGIS WebOrderSystem CVE-2026-4951

Exploitation requires a privileged CustomerAdministration (KundenManager) user - one with employee-search and password-management rights - to be actively logged into the VertiGIS WebOrderSystem portal AND to open an attacker-supplied link whose 'searchValue' URL parameter carries script code. The attacker needs no account but must know the portal URL structure and must deliver the link to, and get interaction from, a privileged victim (UI:A). Limiting factors: no exploitation is possible without an authenticated privileged session on the victim side, user interaction (clicking the link) is mandatory, and only confirmed-affected version 7.0.8.6 is established - other versions are unverified by the vendor.

The input assigns a CVSS 4.0 base score of 5.1 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, and the vuln.today decision label is 'this_month' rather than act_now/emergency, which points to a real but non-urgent priority. The vector is network-reachable with low complexity and no attacker privileges (PR:N), but it is gated by active user interaction (UI:A): exploitation only succeeds if a privileged portal user who is already logged in opens the attacker's crafted link. This is a classic reflected-XSS risk profile - low direct impact on the vulnerable system (VC:N/VI:N/VA:N) but low subsequent-system confidentiality/integrity impact (SC:L/SI:L) reflecting code execution in the victim's authenticated browser context. The CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No EPSS score is provided in the input, so probabilistic exploitation likelihood cannot be stated. The input does not carry a confirmed PoC flag, though a SEC Consult research advisory reference (r.sec-consult.com) is present and the description itself discloses the exact vulnerable parameter and URL-based trigger, which materially lowers the bar for reproduction. The impact ceiling is higher than the base score alone suggests because the advisory notes administrative users can change other users' passwords (including other admins) without the old password - so a successful XSS in an admin session can escalate to full account takeover or lockout. Net assessment: a medium-severity, interaction-dependent issue whose real-world risk is constrained by the need to phish an authenticated privileged user, but whose consequences on success are severe.

An attacker who knows the KundenManager portal URL structure crafts a link embedding JavaScript in the 'searchValue' parameter and sends it (e.g., via phishing) to a portal administrator. When that administrator - already logged into the CustomerAdministration portal - opens the link, the script executes in their authenticated session and can abuse the password-change function to reset other users' credentials. No confirmed working exploit code is flagged in the input, but a public SEC Consult advisory reference exists and the description fully discloses the trigger.