WEBCON BPS XSS flaw patched in latest releases
CERT Polska coordinated disclosure of CVE-2026-1630, a reflected XSS vulnerability in WEBCON BPS allowing JavaScript execution via crafted URLs to authenticated users.
CERT Polska has disclosed CVE-2026-1630, a reflected cross-site scripting vulnerability in WEBCON BPS software. The flaw exists in the /openinmobileapp endpoint, where an attacker can craft a malicious URL containing specially formatted parameters. When an authenticated user opens the URL, arbitrary JavaScript executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise.
The vulnerability was responsibly reported by researcher Konrad Szczepaniak and coordinated through CERT Polska's disclosure process. WEBCON has released patches addressing the issue in versions 2026.1.3.109 and 2025.2.1.293. Organizations running WEBCON BPS should prioritize upgrading to these fixed versions to eliminate the attack surface.
Mentioned in this report
Detection guidance
Reflected XSS Attempt Against WEBCON BPS /openinmobileapp Endpoint
Detects HTTP requests to the WEBCON BPS /openinmobileapp endpoint containing script-injection style parameters indicative of CVE-2026-1630 reflected XSS exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against WEBCON BPS /openinmobileapp Endpoint
id: ef342606-349e-5e5d-964f-96a02f195bc9
status: experimental
description: 'Detects web requests to the WEBCON BPS ''/openinmobileapp'' endpoint
that contain
script-injection style payload markers (e.g. <script>, javascript:, onerror=,
onload=) in the URL query string, consistent with exploitation attempts of
CVE-2026-1630, a reflected XSS vulnerability disclosed by CERT Polska.
'
references:
- https://cert.pl (CVE-2026-1630 advisory)
author: Vorant
tags:
- attack.t1189
- attack.t1059.007
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /openinmobileapp
selection_payload:
cs-uri-query|contains:
- <script
- '%3Cscript'
- 'javascript:'
- onerror=
- onload=
- onfocus=
- <img
- <svg
condition: selection_endpoint and selection_payload
falsepositives:
- Security scanning or vulnerability assessment tools legitimately probing the endpoint
for the disclosed CVE
- Automated web application firewall (WAF) test traffic or penetration testing activity
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-1630
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free