Reflected Cross-Site Scripting in Trimble TM4WEB by Trimble
CVE-2022-35499

7.1HIGH

Key Information:

Vendor

Trimble

Status
TM4WEB
Vendor
CVE Published:
4 September 2026

What is CVE-2022-35499?

In Trimble TM4WEB version 21.4.0.4, a vulnerability exists in the external bill viewer endpoint, which allows an attacker to exploit reflected cross-site scripting (XSS) by injecting malicious scripts through arbitrary parameters in the URL. This could lead to unauthorized data exposure and potential compromise of user sessions.

References

http://tm4web.com
http://trimble.com
https://github.com/PN-Tester/CVE-2022-35499

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.