CVE-2026-3877 — Reflected Cross-Site Scripting in Dashboard Search

CVE-2026-3877

Reflected Cross-Site Scripting in Dashboard Search PUBLISHED

Description (CNA)

A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered through various means, for instance, by sending a link or by tricking victims to visit a page crafted by the attacker.

Affected (CNA)

Vendor / product	Versions
VertiGIS / VertiGIS FM	affected 0 before 10.13.403

CWE

CWE-79

References

https://www.redguard.ch/blog/2026/04/01/advisory-vertigis-vertigisfm/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.