Live › vulnerability › CVE-2026-7004
WIT SynApps Runtime through 1.4.11 reflects the LINK query parameter sent to /System/Session-1 without escaping, so a crafted link runs attacker JavaScript in the victim's browser without logging in. An attacker can use that to harvest credentials, alter the login flow, read browser-visible data and make same-origin requests to controller endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Teams running WIT SynApps Runtime version 1.4.11 or earlier that expose the /System/Session-1 endpoint to users or the internet are exposed. The sources note an origin-switch effect against the internal controller in Cloud RIA setups. Deployments not running this version, or not exposing that endpoint, can skip it.
No product ranges from the sources yet.
1.4.11 are affected./System/Session-1 is reachable from the internet or from untrusted networks.1.4.11; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.
This page as .md · .json · in your agent: get_signal("CVE-2026-7004")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.