Executive brief
Seres Software syWEB, a web-based application, contains a security vulnerability that could allow an attacker to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could potentially steal login session information or perform unauthorized actions on behalf of the user. This issue remains unpatched as the vendor has not responded to disclosure attempts.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Seres Software syWEB through version 03022026. The application fails to properly sanitize or neutralize input before including it in dynamically generated web pages (CWE-79). An unauthenticated remote attacker can exploit this by sending a crafted URL to a victim; if the victim visits the link, the attacker's script executes within the context of the victim's browser session. This can lead to session hijacking, unauthorized data access, or modification of page content. As of the disclosure date, the vendor has not provided a patch or response.
Affected products
- Seres Software syWEB through 03022026
Timeline
- 2026-02-03: advisory: Initial disclosure by TR-CERT/USOM
- 2026-02-03: disclosed: Public disclosure of CVE-2025-8461