CVE-2022-50802
ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
| CWE | CWE-79 |
| Vendor | etap lighting international nv |
| Product | etap safety manager |
| Published | Dec 30, 2025 |
| Last Updated | Mar 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for etap lighting international nv etap safety manager
Be the first to know when new medium vulnerabilities affecting etap lighting international nv etap safety manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
ETAP Lighting International NV / ETAP Safety Manager
1.0.0.32
References
zeroscience.mk: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php packetstormsecurity.com: https://packetstormsecurity.com/files/168339/ exchange.xforce.ibmcloud.com: https://exchange.xforce.ibmcloud.com/vulnerabilities/235743 cxsecurity.com: https://cxsecurity.com/issue/WLB-2022090031 etaplighting.com: https://www.etaplighting.com/ vulncheck.com: https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter
Credits
LiquidWorm as Gjoko Krstic of Zero Science Lab