CVE-2022-50925

8.6 highEPSS 0.4%

High (8.6) in prowise reflect. EPSS 0.4% chance of exploitation in the next 30 days.

Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, opening applications and typing arbitrary text by sending specific WebSocket messages.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-346
Published: 2026-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

prowise:reflect

References

https://www.exploit-db.com/exploits/50796
https://www.prowise.com/
https://www.vulncheck.com/advisories/prowise-reflect-remote-keystroke-injection
https://www.exploit-db.com/exploits/50796

Check your stack JSON