Medium · 5.4 CVE-2026-4772 EUVD-2026-41370GHSA-887m-hc2v-7mwj

Stored XSS in TR7's WAF-ASP

Published Jul 2, 2026 · Updated Jul 2, 2026 · Assigned by TR-CERT

Vendor: TR7 Cyber Defense Product: WAF-ASP

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Stored XSS.

This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

Affected products

Vendor	Product	Affected	Fixed
TR7 Cyber Defense	WAF-ASP	v1.0.324.900 – < v1.4.0.117	v1.4.0.117

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487 government-resource