CVE-2022-35499
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
- Published Sep 4, 2026
- CVSS 7.1 high
- 0.3% chance of exploitation in the next 30 days (EPSS)