CVE-2022-35497

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.

Published 2026-09-04. Last modified 2026-09-14.