CVE-2022-50802 | BDVDB-2026-308256 Detail
ETAP Lighting International NVETAP Safety Manager
Description#
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
- https://packetstormsecurity.com/files/168339/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/235743
- https://cxsecurity.com/issue/WLB-2022090031
- https://www.etaplighting.com/
- https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.