CVE-2022-35499: Trimble TM4Web vulnerability
Published Sep 4, 2026
·Updated
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
Affected Software
1 affected component
Trimble TM4Web=21.4.0.4
Event History
Sep 4, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue is in an external bill viewer endpoint and is triggered by injecting script into an arbitrary parameter appended to its URL. This indicates an attacker can craft a malicious URL for a user to open.
2
Which version is identified as affected?
The reported affected version is Trimble TM4WEB 21.4.0.4.