WEBCON BPS contains a reflected cross‑site scripting flaw in the "/openinmobileapp" endpoint. A crafted URL containing malicious input is reflected back into the page, allowing an attacker to inject and execute arbitrary JavaScript in the victim’s browser. The flaw is identified as a CWE‑79 vulnerability and can compromise the confidentiality and integrity of the user session if exploited.

The affected product is WEBCON BPS. Versions prior to 2026.1.3.109 and 2025.2.1.293 are vulnerable, as the issue was resolved in those releases. Any deployment of older WEBCON BPS versions is at risk.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to click a malicious link; the attacker can then execute code within the victim’s browser, potentially hijacking sessions or collecting sensitive data. The attack vector is likely via phishing or social‑engineering campaigns that embed malicious URLs.