MEDIUM🇵🇱 Wersja polska

CVE-2026-1692

CVSS 5.3v4.0pub. 2026-02-26upd. 2026-03-12

A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website. This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear

  • Arcinformatique Pcvue

    APP
    Arcinformatique
    12.0.0 – 15.2.1316.0.0 – 16.3.4 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-1697MEDIUM5.3ten sam produkt

The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue...

CVE-2026-1693MEDIUM5.3ten sam produkt

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by...

CVE-2026-1698MEDIUM5.3ten sam produkt

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15...

CVE-2026-1695MEDIUM5.3ten sam produkt

An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue fea...

CVE-2022-4311MEDIUM4.7ten sam produkt

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2....