CVE-2026-1630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1630", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-01-29T15:28:27.272Z", "datePublished": "2026-05-14T13:24:14.616Z", "dateUpdated": "2026-08-24T09:48:49.545Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-24T09:48:49.545Z"}, "title": "Reflected XSS in WEBCON BPS", "datePublic": "2026-05-14T13:06:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "WEBCON", "product": "WEBCON BPS", "versions": [{"status": "affected", "version": "2026.1.1.45", "lessThan": "2026.1.3.109", "versionType": "custom"}, {"status": "affected", "version": "2025.1.1.87", "lessThan": "2025.2.1.293", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by \"/openinmobileapp\" endpoint.\u00a0An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.\n\nThis issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by \"/openinmobileapp\" endpoint.&nbsp;An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.<br><br>This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.<br>"}]}], "references": [{"url": "https://cert.pl/en/posts/2026/05/CVE-2026-1630/", "tags": ["third-party-advisory"]}, {"url": "https://community.webcon.com/download/changelog/398?q=db746ec", "tags": ["release-notes"]}, {"url": "https://community.webcon.com/download/changelog/394?q=6a8b113", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Konrad Szczepaniak (Immunity Systems)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T15:17:48.594077Z", "id": "CVE-2026-1630", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:19:00.384Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T15:17:48.594077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:18:11.519Z"}}], "cna": {"title": "Reflected XSS in WEBCON BPS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Konrad Szczepaniak (Immunity Systems)"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WEBCON", "product": "WEBCON BPS", "versions": [{"status": "affected", "version": "2026.1.1.45", "lessThan": "2026.1.3.109", "versionType": "custom"}, {"status": "affected", "version": "2025.1.1.87", "lessThan": "2025.2.1.293", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-05-14T13:06:00.000Z", "references": [{"url": "https://cert.pl/en/posts/2026/05/CVE-2026-1630/", "tags": ["third-party-advisory"]}, {"url": "https://community.webcon.com/download/changelog/398?q=db746ec", "tags": ["release-notes"]}, {"url": "https://community.webcon.com/download/changelog/394?q=6a8b113", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by \"/openinmobileapp\" endpoint.\u00a0An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.\n\nThis issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.", "supportingMedia": [{"type": "text/html", "value": "WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by \"/openinmobileapp\" endpoint.&nbsp;An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.<br><br>This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-24T09:48:49.545Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1630", "state": "PUBLISHED", "dateUpdated": "2026-08-24T09:48:49.545Z", "dateReserved": "2026-01-29T15:28:27.272Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-05-14T13:24:14.616Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WEBCON BPS", "vendor": "WEBCON", "versions": [{"lessThan": "2026.1.3.109", "status": "affected", "version": "2026.1.1.45", "versionType": "custom"}, {"lessThan": "2025.2.1.293", "status": "affected", "version": "2025.1.1.87", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by \"/openinmobileapp\" endpoint.\u00a0An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.\n\nThis issue was fixed in versions 2026.1.3.109 and 2025.2.1.293."}, {"lang": "es", "value": "WEBCON BPS es vulnerable a XSS Reflejado a trav\u00e9s de uno de los par\u00e1metros utilizados por el endpoint \u2019/openinmobileapp\u2019. Un atacante puede enviar una URL especialmente dise\u00f1ada que, al ser abierta por un usuario autenticado, resulta en la ejecuci\u00f3n arbitraria de JavaScript en el navegador de la v\u00edctima.\n\nEste problema fue solucionado en las versiones 2026.1.3.109 y 2025.2.1.293."}], "id": "CVE-2026-1630", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1630", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T15:17:48.594077Z", "version": "2.0.3"}}]}, "published": "2026-05-14T14:16:16.537", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/05/CVE-2026-1630/"}, {"source": "cvd@cert.pl", "url": "https://community.webcon.com/download/changelog/394?q=6a8b113"}, {"source": "cvd@cert.pl", "url": "https://community.webcon.com/download/changelog/398?q=db746ec"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2026.1.1.45,2026.1.3.109)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2025.1.1.87,2025.2.1.293)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WEBCON BPS", "source": "cna", "vendor": "WEBCON"}, "product": "webcon_bps", "vendor": "webcon"}], "created": "2026-05-14T15:15:23.156335+00:00", "updated": "2026-05-17T17:09:16.522886+00:00", "vendors": ["webcon", "webcon$PRODUCT$webcon_bps"]}