CVE-2026-3877: Reflected Cross-Site Scripting in Dashboard Search
A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered through various means, for instance, by sending a link or by tricking victims to visit a page crafted by the attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3877?
CVE-2026-3877 is considered a critical reflected cross-site scripting vulnerability.
How do I fix CVE-2026-3877?
To fix CVE-2026-3877, ensure that proper input validation and output encoding are implemented in the dashboard search functionality.
Who is affected by CVE-2026-3877?
Users of the VertiGIS FM solution are affected by CVE-2026-3877.
What type of attack does CVE-2026-3877 facilitate?
CVE-2026-3877 facilitates reflected cross-site scripting attacks.
Can CVE-2026-3877 be exploited remotely?
Yes, CVE-2026-3877 can be exploited remotely if an authenticated user visits a crafted malicious URL.