PT-2026-29518

CVE-2026-3877

Published

2026-04-01

Updated

2026-04-01

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions VertiGIS FM (affected versions not specified)

Description A reflected cross-site scripting (XSS) vulnerability exists in the dashboard search functionality. Attackers can create a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript code within the user's session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Andreas Pfefferle

Benjamin Faller

David Wischnjak

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')