CVE-2022-35499

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.

Published 2026-09-04. Last modified 2026-09-08.