CVE-2026-1630

MediumCVSS 5.1

Published: 14/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

37th percentile - higher than 37% of all known CVEs

Summary

WEBCON BPS is vulnerable to reflected XSS via one of the parameters used by the "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. The issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Risk Assessment

An attacker could execute arbitrary JavaScript in the context of an authenticated user's session, potentially leading to session data theft or actions performed on behalf of the victim. This requires luring the user into opening a crafted link.

Recommendation

Update WEBCON BPS to version 2026.1.3.109 or 2025.2.1.293 (or later). Inform users about the risk of opening unknown links.

Other vulnerabilities in WEBCON BPS

CVE-2026-92419Medium
WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply arbitrary user logins in the selectedPeople parameter to view vacation schedules of other employees, including managers and staff from other offices, regardless of business logic access restrictions, resulting in unauthorized disclosure of sensitive scheduling information. This vulnerability was fixed in versions: 2025.2.1.177 and 2026.1.1.20.

Original NVD description (English source)

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS