TranzAxis CVE-2025-66574

Requires a valid authenticated TranzAxis session (PR:L) with the ability to submit input through the 'Open Object in Tree' endpoint, where the injected script is persistently stored. Realistic impact depends on a second, typically higher-privileged operator subsequently opening the malicious object in the tree to trigger execution - so exploitation is gated by (1) authenticated access to the application and (2) a victim viewing the crafted object. There is no indication the flaw is reachable pre-authentication or against an unauthenticated default configuration.

This is a moderate-severity, low-priority issue rather than an urgent one. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and describes a network-reachable, low-complexity flaw that nonetheless requires authentication (PR:L) and yields only low-magnitude confidentiality/integrity impact with a scope change (SC:L/SI:L) - consistent with a stored XSS. EPSS is very low (0.03%, 10th percentile), indicating no meaningful signal of mass exploitation, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. However, publicly available exploit code exists (Exploit-DB 52086), which raises the practical likelihood of opportunistic use against exposed, authenticated-access instances. These signals are consistent rather than conflicting: a real but low-urgency weakness. One nuance to verify: the vendor vector lists UI:N, yet stored XSS normally requires a victim to view the injected object, which would imply user interaction - this materially affects real-world exploitability and should be confirmed with the vendor/VulnCheck advisory.

An authenticated user of TranzAxis submits a crafted object name/field through the 'Open Object in Tree' endpoint containing a malicious script payload, which is stored and later rendered when another operator opens that object in the tree view. The script executes in the victim's authenticated session context, enabling theft of session cookies and potential privilege escalation if a higher-privileged operator triggers it. Public exploit code (Exploit-DB 52086) exists, lowering the skill barrier for reproduction.