CVE-2026-7004
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints.
Risk Assessment
An attacker can harvest user credentials and perform actions in the context of their session, including attacks against the internal controller.
Recommendation
Update WIT SynApps Runtime to a patched version and implement input validation and encoding at the /System/Session-1 endpoint.
Other vulnerabilities in WIT SynApps Runtime
See all- CVE-2026-7005Medium
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate enrollment against REDY instances, crossing IT/OT segmentation boundaries.
- CVE-2026-7003Medium
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability. Static OAuth clientId and clientSecret values are embedded in JavaScript delivered to the frontend, such as in parameters.js, allowing unauthenticated attackers to recover them.
Original NVD description (English source)
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS