CVE-2026-1630: Reflected XSS in WEBCON BPS

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-10-26
Weakness: CWE-79

Description

WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.

Affected products

WEBCON BPS: from 2026.1.1.45 before 2026.1.3.109; from 2025.1.1.87 before 2025.2.1.293 — fixed in 2025.2.1.293, 2026.1.3.109

How to fix

Upgrade to a fixed version: WEBCON BPS 2025.2.1.293, 2026.1.3.109. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-1630 or the next vulnerability affects your stack