CVE-2022-35499

21th percentile - higher than 21% of all known CVEs

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in an arbitrary parameter appended to the URL.

An attacker can exploit the vulnerability to execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other attacks.

Update Trimble TM4WEB to the latest version and apply proper input filtering and encoding for URL parameters.