WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• vulncheck.com/…napps-runtime-reflected-xss-via-link-parameter Üçüncü taraf
• github.com/…142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIT İstismar kodu ya da analiz

Kayıt geçmişi

1. 30 Eki 2026 21:59Yayımlandı

İlgili açıklar

• 6,1 CVE-2026-7005WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding
• 5,3 CVE-2026-7003WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
• 6,5 CVE-2026-116854WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
• 7,1 CVE-2026-116851WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
• 7,1 CVE-2026-116847WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
• 7,1 CVE-2026-116405WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability