ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter

Advisories

severity: medium
date: December 30, 2025
Affecting: ETAP Safety Manager 1.0.0.32
CVE: CVE-2022-50802
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References: Zero Science Lab Disclosure (ZSL-2022-5711)
Packet Storm Security Exploit Entry
IBM X-Force Vulnerability Exchange
CXSecurity Vulnerability Database
ETAP Vendor Homepage
Credit: LiquidWorm as Gjoko Krstic of Zero Science Lab
Description: ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.