OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-1630

UNKNOWN · CVSS N/A EPSS 0.43%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-05-14 · Last synced 2026-08-04

CyberRota Analysis

This vulnerability has an unknown severity rating. It affects Java. Exploitation may require the attacker to be authenticated.

CVE
CVE-2026-1630
Severity
UNKNOWN
CVSS
N/A
EPSS
0.43%
Java

Original NVD Description

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.