Skip to content
OpenAdvisories

Vendor

WEBCON

2 known vulnerabilities.

Products

WEBCON BPS 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-92419

    IDOR in WEBCON BPS

    WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' …

    WEBCON WEBCON BPS
  • Medium 5.1
    CVE-2026-1630

    Reflected XSS in WEBCON BPS

    WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. Th…

    WEBCON WEBCON BPS