PT-2025-49150

Name of the Vulnerable Software and Affected Versions TranzAxis version 3.2.41.10.26 Description Authenticated users can inject cross-site scripting through the Open Object in Tree API endpoint. Successful exploitation may allow attackers to steal session cookies and potentially escalate...

CVE-2025-66574: Improper Neutralization of Input During Web Page Generation

TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...