Syweb
Monthly
Account footprinting via observable discrepancy in Seres Software syWEB exposes valid user account existence to unauthenticated remote attackers. All versions through 27082026 are affected, and the vendor has confirmed the product is end-of-life with no support - meaning no patch will ever be released. No public exploit code or CISA KEV listing has been identified, but the permanently unpatched status elevates long-term risk for any remaining deployments.
Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. No public exploit code has been identified at time of analysis, and the product has no CISA KEV listing.
Account footprinting via observable discrepancy in Seres Software syWEB exposes valid user account existence to unauthenticated remote attackers. All versions through 27082026 are affected, and the vendor has confirmed the product is end-of-life with no support - meaning no patch will ever be released. No public exploit code or CISA KEV listing has been identified, but the permanently unpatched status elevates long-term risk for any remaining deployments.
Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. No public exploit code has been identified at time of analysis, and the product has no CISA KEV listing.