CVE-2022-50787

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Stored Cross-Site Scripting

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated username input to execute arbitrary HTML and JavaScript code in victim browser sessions without authentication.

Affected

SOUND4 Ltd. · Kantar Media · Impact/Pulse/First · Impact/Pulse Eco · BigVoice4 · BigVoice2 · Stream · WM2

CVSS v4.0 VULNCHECK

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.44% chance of exploitation in the next 30 days, 37th percentile

Published

2025-12-30

Updated

2026-10-01

Proof-of-concept exploits (1)

• https://packetstormsecurity.com/files/170258/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Persistent…

Security advisories

• https://exchange.xforce.ibmcloud.com/vulnerabilities/247920
• https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-stored-c…
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5731.php
• https://www.sound4.com

References

• CVE Record
• NVD entry