CVE-2022-50787 | THREATINT

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated username input to execute arbitrary HTML and JavaScript code in victim browser sessions without authentication.

PUBLISHED Reserved 2025-12-26 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Version 2: 1.1/2.15

affected

1.16

affected

1.2

affected

1.30

affected

1.1/2.4.29

affected

1.11

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5731.php (Zero Science Lab Disclosure (ZSL-2022-5731)) third-party-advisory

packetstormsecurity.com/...sistent-Cross-Site-Scripting.html (Packet Storm Security Exploit Details) exploit

exchange.xforce.ibmcloud.com/vulnerabilities/247920 (IBM X-Force Vulnerability Exchange Entry) vdb-entry

www.sound4.com/ (SOUND4 Product Homepage) product

www.vulncheck.com/...thenticated-stored-cross-site-scripting (VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Stored Cross-Site Scripting) third-party-advisory

cve.org (CVE-2022-50787)

nvd.nist.gov (CVE-2022-50787)

Download JSON