Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS.

This issue affects syWEB: through 27082026.
NOTE: The vendor was contacted and it was learned that the product is not supported.
Published: 2026-08-27
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper neutralization of user input during the generation of web pages in Seres Software syWEB, allowing attackers to inject and execute arbitrary JavaScript when a victim visits a crafted URL. This reflects a typical injection weakness identified as CWE‑79 and can lead to theft of session cookies, service compromise, or defacement.

Affected Systems

Affected are all installations of SyWEB from the vendor Seres Software up to, and including, version 27082026. The product is no longer supported, so no official patch is currently available.

Risk and Exploitability

Based on the CVSS score of 6.1, the flaw is of moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploit has been recorded yet. Attackers can likely exploit the flaw simply by sending a maliciously crafted link or embedding the URL in social media or email; no authentication or privileged access is required.

Generated by OpenCVE AI on August 27, 2026 at 17:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Replace or upgrade SyWEB to a supported application that provides proper input sanitization
  • Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted domains
  • Configure a Web Application Firewall or browser‑side filtering to detect and block reflected XSS payloads
  • Ensure all outbound links from SyWEB are properly encoded for the context in which they are displayed

Generated by OpenCVE AI on August 27, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Seres Software
Seres Software syweb
Vendors & Products Seres Software
Seres Software syweb

Thu, 27 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
Title Reflected XSS in Seres Software's syWEB
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Seres Software Syweb
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-08-27T13:39:12.905Z

Reserved: 2026-06-09T06:49:14.351Z

Link: CVE-2026-11747

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-27T17:17:07.000

Modified: 2026-08-27T17:17:07.000

Link: CVE-2026-11747

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T17:30:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')