# WEBCON BPS XSS flaw patched in latest releases

Published: 2026-05-14 · Severity: medium
Canonical: https://vorant.io/reports/75cc2ffb-633d-50dc-bc7e-a0cc2943e6c0/webcon-bps-xss-flaw-patched-in-latest-releases

> CERT Polska coordinated disclosure of CVE-2026-1630, a reflected XSS vulnerability in WEBCON BPS allowing JavaScript execution via crafted URLs to authenticated users.

CERT Polska has disclosed CVE-2026-1630, a reflected cross-site scripting vulnerability in WEBCON BPS software. The flaw exists in the /openinmobileapp endpoint, where an attacker can craft a malicious URL containing specially formatted parameters. When an authenticated user opens the URL, arbitrary JavaScript executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise.

The vulnerability was responsibly reported by researcher Konrad Szczepaniak and coordinated through CERT Polska's disclosure process. WEBCON has released patches addressing the issue in versions 2026.1.3.109 and 2025.2.1.293. Organizations running WEBCON BPS should prioritize upgrading to these fixed versions to eliminate the attack surface.

## Mentioned in this report

- Vulnerabilities: CVE-2026-1630

## Detection guidance (public sample)

### Reflected XSS Attempt Against WEBCON BPS /openinmobileapp Endpoint

ATT&CK: T1189

Detects HTTP requests to the WEBCON BPS /openinmobileapp endpoint containing script-injection style parameters indicative of CVE-2026-1630 reflected XSS exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reflected XSS Attempt Against WEBCON BPS /openinmobileapp Endpoint
id: ef342606-349e-5e5d-964f-96a02f195bc9
status: experimental
description: 'Detects web requests to the WEBCON BPS ''/openinmobileapp'' endpoint
  that contain

  script-injection style payload markers (e.g. <script>, javascript:, onerror=,

  onload=) in the URL query string, consistent with exploitation attempts of

  CVE-2026-1630, a reflected XSS vulnerability disclosed by CERT Polska.

  '
references:
- https://cert.pl (CVE-2026-1630 advisory)
author: Vorant
tags:
- attack.t1189
- attack.t1059.007
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: /openinmobileapp
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - 'javascript:'
    - onerror=
    - onload=
    - onfocus=
    - <img
    - <svg
  condition: selection_endpoint and selection_payload
  falsepositives:
  - Security scanning or vulnerability assessment tools legitimately probing the endpoint
    for the disclosed CVE
  - Automated web application firewall (WAF) test traffic or penetration testing activity
  level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-1630

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/75cc2ffb-633d-50dc-bc7e-a0cc2943e6c0/webcon-bps-xss-flaw-patched-in-latest-releases.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup