Description
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.
Published: 2026-10-30
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Reflected Cross‑Site Scripting allowing client‑side code execution
Action: Immediate Update
AI Analysis

Impact

This vulnerability is a pre‑authentication reflected XSS that permits an unauthenticated attacker to inject and execute arbitrary JavaScript by sending a crafted LINK query parameter to the /System/Session‑1 endpoint. The injected code can harvest credentials, manipulate the login flow, read browser‑visible data, and perform same‑origin requests to internal controller endpoints, including an origin‑switch primitive in Cloud RIA scenarios.

Affected Systems

The affected product is WIT SynApps Runtime version 1.4.11 and earlier. All releases up to and including 1.4.11 are affected.

Risk and Exploitability

The CVSS score of 5.1 classifies the vulnerability as moderate severity, and no EPSS score is provided, indicating limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by constructing a malicious URL or by an application that sends a crafted request to the vulnerable endpoint. The impact is client‑side and would require a victim to load the malicious link, a scenario that is likely on shared or open components.

Generated by OpenCVE AI on October 30, 2026 at 21:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s official patch or upgrade to a version of SynApps Runtime newer than 1.4.11.
  • If an update is not immediately available, restrict access to the /System/Session‑1 endpoint to authenticated users only or deploy a web application firewall rule that blocks malicious LINK parameters.
  • Ensure that any user‑input that may be reflected in responses is properly encoded or sanitized in accordance with CWE‑79 best practices.

Generated by OpenCVE AI on October 30, 2026 at 21:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wit
Wit synapps Runtime
Vendors & Products Wit
Wit synapps Runtime

Fri, 30 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.
Title WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Wit Synapps Runtime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T22:15:23.482Z

Reserved: 2026-04-24T20:48:26.294Z

Link: CVE-2026-7004

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T19:19:13.797

Modified: 2026-10-30T23:17:15.970

Link: CVE-2026-7004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T22:48:56Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')