CVE-2022-35497
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.
- Published Sep 4, 2026
- CVSS 5.4 medium
- 0.3% chance of exploitation in the next 30 days (EPSS)