# CVE-2026-4952: VertiGIS WebOrderSystem stored cross-site scripting in OrderAdministration

Source: https://junglewise.ai/threats/cve-2026-4952-the-asmobile-web-interface-which-is-part-of-the-vertigis-software  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-4952 · Severity: info · Published 2026-10-23

VertiGIS WebOrderSystem is a web-based order management portal used by enterprises. A stored cross-site scripting vulnerability in the OrderAdministration portal (AuftragsManager) allows attackers to inject malicious JavaScript into order details, which executes when high-privileged administrators view affected orders. This can lead to account takeover, unauthorized actions, or data theft from administrator sessions.

Technologies: [VertiGIS WebOrderSystem](https://junglewise.ai/threats/technologies/webordersystem). Vendors: [VertiGIS](https://junglewise.ai/threats/vendors/vertigis).

## Quick answers

**Is CVE-2026-4952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4952 being exploited in the wild.

**How severe is CVE-2026-4952?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** VertiGIS WebOrderSystem <=7.0.8.6.

**Is there a fix for CVE-2026-4952?** No fixed version is recorded yet. Apply the vendor-provided workaround for CVE-2026-4952 while awaiting an official patch. Contact VertiGIS for details on hardening measures and the status of fixes planned for the LM Explorer product.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2025-01-14"},{"kind":"advisory","at":"2026-10-23"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4952 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-4952?** Check whether you run VertiGIS WebOrderSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply the vendor-provided workaround for CVE-2026-4952 while awaiting an official patch. Contact VertiGIS for details on hardening measures and the status of fixes planned for the LM Explorer product.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2025-01-14"},{"kind":"advisory","at":"2026-10-23"}]

## Technical details

Stored XSS in the OrderAdministration portal (AuftragsManager) where JavaScript injected into the business reference field via the ASMobile web interface (part of GIS Portal) persists in order details and executes when privileged users open orders. The vulnerability requires an authenticated user to inject the payload via ASMobile, but execution occurs in the context of a high-privileged OrderAdministration user. No patch has been disclosed by the vendor.

## Affected products

- VertiGIS WebOrderSystem <=7.0.8.6

## References

- [https://r.sec-consult.com/vertigis](https://r.sec-consult.com/vertigis)

## Related threats

- [VertiGIS WebOrderSystem reflected cross-site scripting in KundenManager](https://junglewise.ai/threats/cve-2026-4951-the-customeradministration-portal-kundenmanager-of-vertigis)
- [VertiGIS WebOrderSystem stored XSS in CustomerAdministration portal](https://junglewise.ai/threats/cve-2026-4950-the-customeradministration-portal-kundenmanager-of-vertigis)