Webordersystem Auftragsmanager
Monthly
Stored cross-site scripting in VertiGIS GIS Portal's ASMobile business-reference field can be carried into an order and executed in the OrderAdministration (AuftragsManager) portal of VertiGIS WebOrderSystem when a highly privileged user opens that order. Exploitation requires an authenticated ASMobile user who can create a business reference and place an order, followed by the privileged administrator interaction; WebOrderSystem 7.0.8.6 is confirmed affected, while other versions are unverified. No public exploit was identified at time of analysis, and the available signals indicate a moderate, not urgent, risk (CVSS 4.0 base 5.1; decision this_month).
Stored cross-site scripting in VertiGIS GIS Portal's ASMobile business-reference field can be carried into an order and executed in the OrderAdministration (AuftragsManager) portal of VertiGIS WebOrderSystem when a highly privileged user opens that order. Exploitation requires an authenticated ASMobile user who can create a business reference and place an order, followed by the privileged administrator interaction; WebOrderSystem 7.0.8.6 is confirmed affected, while other versions are unverified. No public exploit was identified at time of analysis, and the available signals indicate a moderate, not urgent, risk (CVSS 4.0 base 5.1; decision this_month).