Medium severity · published Dec 30, 2025
CVE-2022-50802
ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
ETAP Safety Manager · ETAP Lighting International NV
1.0.0.32 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-50802
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-50802
Third Party Advisory
https://cxsecurity.com/issue/WLB-2022090031
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/235743
Third Party Advisory
https://packetstormsecurity.com/files/168339/
Product
https://www.etaplighting.com/
Third Party Advisory
https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php