← Back to CVEs

CVE-2022-50802

MEDIUM

6.1

Description

ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.

CVE Details

CVSS v3.1 Score6.1

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published12/30/2025

Last Modified1/7/2026

Sourcenvd

Honeypot Sightings0

Affected Products

etaplighting:etap_safety_manager

Weaknesses (CWE)

CWE-79

References

https://cxsecurity.com/issue/WLB-2022090031(disclosure@vulncheck.com)

https://exchange.xforce.ibmcloud.com/vulnerabilities/235743(disclosure@vulncheck.com)

https://packetstormsecurity.com/files/168339/(disclosure@vulncheck.com)

https://www.etaplighting.com/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php(disclosure@vulncheck.com)

https://cxsecurity.com/issue/WLB-2022090031(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.