VertiGIS WebOrderSystem CVE-2026-4952

Exploitation requires (1) a valid authenticated ASMobile (GIS Portal) account able to create a business reference and place an order, and (2) a highly privileged user subsequently opening that specific order in the OrderAdministration/AuftragsManager portal of VertiGIS WebOrderSystem - this admin interaction (UI:P) is the firing trigger, since on its own the injection is only self-XSS affecting the submitting user. Limiting factors: the attacker cannot self-trigger the privileged impact, must first obtain authenticated access, and is dependent on an administrator viewing the malicious order. Confirmed affected: WebOrderSystem 7.0.8.6; behavior on other versions is unverified because the vendor disclosed no additional affected versions.

This is a medium-severity stored cross-site scripting flaw (CWE-79, CVSS 4.0 base 5.1) and the available signals point to a moderate, not urgent, real-world risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows network reach and low attack complexity, but two factors materially constrain exploitation: PR:L means the attacker must already hold a valid (low-privileged) authenticated ASMobile account, and UI:P means a separate highly-privileged administrator must passively open the malicious order in the AuftragsManager portal before the payload fires. The impact metrics (VC:N/VI:N/VA:N on the vulnerable system, with SC:L/SI:L on the subsequent system) correctly reflect that the damage lands in the privileged admin's browser context rather than on the ASMobile system itself - a cross-privilege escalation path, but limited in confidentiality/integrity effect. No EPSS score is present in the input, no CISA KEV listing applies, and no confirmed working exploit code is provided (only a SEC Consult advisory reference). The vuln.today decision label is 'this_month', consistent with a genuine issue that warrants scheduled remediation rather than emergency action. Net: a legitimate cross-privilege stored-XSS requiring insider/authenticated access plus admin interaction - prioritize for this patch cycle, but it is not a mass-exploitable, internet-facing emergency. EPSS data is absent, so probabilistic exploitation likelihood could not be weighed.

A low-privileged but authenticated ASMobile user enters JavaScript into the 'business reference' field and places an order; the payload is stored in the order details. When a highly privileged operator later opens that order in the OrderAdministration (AuftragsManager) portal of VertiGIS WebOrderSystem, the script executes in the privileged user's session. A SEC Consult (SEC-VLab) advisory describes the issue, but no verified working exploit code was identified in the input.