PT-2026-40916 · Webcon · Webcon Bps

Konrad Szczepaniak · Publicado 2026-05-14 · Atualizado 2026-05-14 · CVE-2026-1630

NVD

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.

This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-1630

Produtos afetados

Webcon Bps

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-1630 · Nota de Segurança
• https://community.webcon.com/download/changelog/398?q=db746ec · Nota
• https://community.webcon.com/download/changelog/394?q=6a8b113 · Nota
• https://cert.pl/en/posts/2026/05/CVE-2026-1630 · Nota