CVE-2022-50787 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Stored Cross-Site Scripting
Unauthenticated attackers can inject malicious scripts via the username parameter, leading to arbitrary code execution in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-50787?
CVE-2022-50787 is a medium-severity cross-site scripting vulnerability in Kantar Media BigVoice2, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated username input to execute arbitrary HTML and JavaScript code in victim browser sessions without authentication.
Weakness: CWE-79
Which versions are affected by CVE-2022-50787?
It affects 9 products.
Products include Sound4 Big Voice2 Firmware, Sound4 Big Voice4 Firmware, Sound4 First Firmware, Sound4 Impact Eco Firmware, Sound4 Impact Firmware, Sound4 Pulse Eco Firmware and 3 more.
How do I fix CVE-2022-50787?
No fix has been published for CVE-2022-50787 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-50787 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-50787 exists.
Other vulnerabilities in Kantar Media BigVoice2
- CVE-2022-50696 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass
- CVE-2022-50794 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username
- CVE-2022-50796 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi
- CVE-2023-53955 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References
- CVE-2023-53960 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass
Sources
Also known as GHSA-gxjj-79fr-px4p.