CVE-2026-7004

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this...

CVE-2026-7003

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

CVE-2026-7005

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-7005 WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-7005

WIT SynApps Runtime versions through 1.4.11 are vulnerable to a browser-mediated cross-origin request forgery (CRof) . This flaw allows an attacker to provide an arbitrary target address during controller onboarding, forcing the victim's browser to issue discovery requests to attacker-specified h...

EUVD-2026-114362

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-7004 WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this...

EUVD-2026-114265

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this...

CVE-2026-7004

WIT SynApps Runtime versions through 1.4.11 are vulnerable to a pre-authentication reflected cross-site scripting (XSS) flaw. The issue is caused by insufficient neutralization of the LINK query parameter on the /System/Session-1 endpoint, allowing unauthenticated attackers to execute arbitrary J...

CVE-2026-7003 WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

CVE-2026-7003

WIT SynApps Runtime versions through 1.4.11 are vulnerable to a hardcoded credentials vulnerability. Attackers can recover static OAuth clientId and clientSecret values embedded in JavaScript files (such as parameters.js ) delivered to the frontend. These exposed credentials allow unauthenticated...

EUVD-2026-114263

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

CVE-2026-7003: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers…

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

CVE-2026-7005: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows…

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-7004: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that…

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this...