PT-2026-40916 · Webcon · Webcon Bps

Konrad Szczepaniak · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-1630

NVD

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.

This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1630

Affected Products

Webcon Bps

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-1630 · Security Note
• https://community.webcon.com/download/changelog/398?q=db746ec · Note
• https://community.webcon.com/download/changelog/394?q=6a8b113 · Note
• https://cert.pl/en/posts/2026/05/CVE-2026-1630 · Note