VertiGIS WebOrderSystem EUVD-2026-108612

Exploitation requires an authenticated user with privileged access to the CustomerAdministration (KundenManager) portal who is able to edit employees of defined companies/user groups; the attacker stores JavaScript in an editable user property such as 'secondName'. Execution additionally requires a second privileged user to open the edited user entry or the corresponding user-group overview (passive user interaction), and the resulting script runs only in that victim's authenticated portal session. Limiting factors: high privilege level needed to inject (PR:H), required victim interaction, and impact restricted to other privileged portal operators rather than anonymous or lower-privileged users. Version 7.0.8.6 is confirmed affected; behavior on other versions is not stated by the vendor.

This is a genuinely medium/low-priority issue rather than an urgent one, and the signals agree. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) scores 4.8 and reflects a stored cross-site scripting flaw that requires high privileges (PR:H - an authenticated, privileged portal user) plus passive interaction from a victim (UI:P), with impact confined to the subsequent system (VC:N/VI:N/VA:N but SC:L/SI:L), i.e. the browser session of another privileged user rather than the server itself. No KEV listing is present, no EPSS probability was supplied, and the single reference (a SEC Consult/SEC-VLab advisory) is not a verified working exploit, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which is consistent with a vulnerability that matters but is not an emergency. The main gating factor is that the attacker must already hold privileged (employee/company-management) access to the KundenManager portal, which makes this primarily a privilege-escalation-between-operators / insider or compromised-account scenario rather than a broadly exploitable external flaw. No key signals are missing in a way that would change the conclusion; the only notable gap is that the vendor did not confirm which versions beyond 7.0.8.6 are affected.

An authenticated attacker who already has privileged access to the CustomerAdministration (KundenManager) portal edits an employee record and places JavaScript in a user property such as 'secondName'. When another privileged user later opens that user entry or the user-group overview, the stored script executes in their authenticated session, allowing session-context actions against the second operator. No public exploit code is identified; the only reference is a vendor advisory, not a verified PoC.