CVE-2022-50787

Katalog CVE

CVSS 7.2 · High EPSS 0,44%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada sound4 first firmware, sound4 impact eco firmware +7 lainnya. Skor CVSS 3.1 7.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated username input to execute arbitrary HTML and JavaScript code in victim browser sessions without authentication.

Rincian

Terbit di NVD

30 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exchange.xforce.ibmcloud.com/vulnerabilities/247920 advisory pihak ketiga
• https://packetstormsecurity.com/files/170258/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Persistent-Cross-Site-Scripting... exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-stored-cross-site-scripting advisory pihak ketiga
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5731.php exploit · advisory pihak ketiga
• https://www.sound4.com/ product