Is CVE-2026-7004 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-7004?

CVE-2026-7004 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-7004

Description

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.