This vulnerability (CVE-2025-66574) in TranzAxis 3.2.41.10.26 arises from improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). Authenticated users can exploit the 'Open Object in Tree' endpoint to inject malicious scripts. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity with limited scope and low impact on availability. No known exploits are reported in the wild, and no patches or vendor advisories are currently available.

Exploitation of this vulnerability can lead to theft of session cookies, which may allow attackers to hijack user sessions and potentially escalate privileges within the affected TranzAxis application. The impact is limited to authenticated users and the scope is confined to the affected version 3.2.41.10.26. There is no indication of broader system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity. Avoid using the vulnerable version in production environments if possible.