Webcon

2 CVEs in 1 Webcon product, including Webcon Bps. Newest: CVE-2026-92419 (2026-09-23). Severity, EPSS and public exploits for each.

Webcon products with known CVEs

ProductCVEs
Webcon Bps2
Webcon CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-924192026-09-23WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation c…
CVE-2026-16302026-05-14WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when op…