CVE-2025-66574

Published: Dec 4, 2025

Modified: Apr 7, 2026

PUBLISHED

Description

TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.

Vendor	Product	Versions
Compass Plustechologies	TranzAxis	affected `3.2.41.10.26`

Weaknesses (CWE)

CWE-79

References

ExploitDB-52086

exploit

Compass Technologies Homepage

product

https://www.vulncheck.com/advisories/tranzaxis-32411026-stored-cross-site-scripting-xss

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-66574

Description

Affected Products

Weaknesses (CWE)

References