CVE-2022-50925

CRITICAL

9.8

Descricao

Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, opening applications and typing arbitrary text by sending specific WebSocket messages.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado1/13/2026

Ultima modificacao1/30/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

prowise:reflect

Fraquezas (CWE)

CWE-346

Referencias

https://www.exploit-db.com/exploits/50796(disclosure@vulncheck.com)

https://www.prowise.com/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/prowise-reflect-remote-keystroke-injection(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/50796(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.