CVE-2022-50787

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated username input to execute arbitrary HTML and JavaScript code in victim browser sessions without authentication.

View graph Watch Export

CVSS v3.1

7.2 HIGH

EPSS

0.45%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 16, 2026 → Aug 28, 2026

▲ 0.05pp

0.40% → 0.45% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityLOW

IntegrityLOW

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Connections

10 relationships

CWE-79

source

Timeline

disclosure → media coverage

Dec 30, 2025

Disclosure — published as a CVE record. · last revised by NVD Jan 13, 2026