WIT SynApps Runtime CVE-2026-7004

Exploitation requires sending a victim a crafted URL to the /System/Session-1 endpoint of WIT SynApps Runtime (versions through 1.4.11) carrying a malicious LINK query parameter; no authentication is required (PR:N) but the attack is gated on user interaction (UI:A) - a user must open the attacker-supplied link for the reflected payload to execute. Because the XSS is reflected rather than stored, each exploitation depends on social-engineering delivery and is non-persistent. The highest-impact variant - the origin-switch primitive against the internal controller - is limited to Cloud RIA deployment scenarios as described in the advisory; standard deployments face credential harvesting, login-flow manipulation, and same-origin requests within the browser context.

This is a medium-severity, pre-authentication reflected XSS (CVSS 4.0 base 5.1) whose real-world urgency sits well below its unauthenticated reachability. The vector is network-facing with low complexity and no privileges (AV:N/AC:L/AT:N/PR:N), which makes the endpoint trivially reachable, but UI:A means a victim must actively open an attacker-crafted link, so this is not a wormable or server-takeover issue. Impact is confined to the subsequent (browser) system - SC:L/SI:L with VC/VI/VA:N - reflecting that the flaw yields no direct impact on the server runtime itself, only on the user's session and same-origin context. No EPSS score and no KEV status are present in the supplied data, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the vuln.today decision label is this_month, i.e. patch on a normal cycle rather than as an emergency. A public PoC reference exists but is not verified as working exploit code, so weaponization is plausible but unconfirmed. The elevated concern is situational: in Cloud RIA deployments the described origin-switch primitive against the internal controller could let a reflected payload pivot to same-origin controller requests, which raises the practical impact above a generic credential-phishing XSS for those specific topologies.

An attacker crafts a URL to the /System/Session-1 endpoint of a WIT SynApps Runtime instance (≤1.4.11) with a malicious LINK query parameter and lures a user into clicking it, for example via phishing. When the victim's browser renders the reflected response, the injected JavaScript executes in the SynApps origin, letting the attacker scrape login credentials, tamper with the login flow, or issue same-origin requests to controller endpoints. A public PoC reference exists but is not verified as working exploit code.