The CustomerAdministration portal in VertiGIS WebOrderSystem allows privileged users to edit employee records; the "secondName" field accepts arbitrary JavaScript code which is stored and later executed in the browsers of any other privileged user who views the edited user entry or the group overview. This stored Cross‑Site Scripting vulnerability (CWE‑79) permits an authenticated attacker to run script code within the session of other portal users, potentially hijacking sessions, defacing content, or executing further client‑side attacks.

The vulnerability is present in VertiGIS Ltd. WebOrderSystem (KundenManager) version 7.0.8.6, the latest available at the time of testing. No additional affected versions have been disclosed by the vendor but it is possible that earlier releases are also vulnerable.

The CVSS score of 4.8 indicates a moderate impact; the exploit probability (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and possess privileged access to the portal, a condition that limits the attack surface to users with elevated permissions. Given the lack of a publicly available exploit, the likelihood of exploitation is currently low but not negligible for organizations with extensive privileged user bases.