EUVD-2026-67134
GHSA-5qh6-895j-vpwx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring victim click (UI:R); no attacker auth needed; scope changes to browser context; no availability impact; independently consistent with the vendor-supplied vector.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS.
This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim user clicks or is redirected to an attacker-crafted URL pointing at the syWEB application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 (Medium) score reflects a standard reflected XSS profile: network-accessible (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but requiring active victim interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the vendor has explicitly confirmed syWEB is unsupported and will not issue a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today