Security Advisory

CVE-2026-1630

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-14 13:24:14

Last updated 2026-05-14 15:19:00

Assigner CERT-PL

CVSS score 5.1

State PUBLISHED

Description

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

← Browse all CVEs View on cve.org ↗