CVE-2022-50925 | Prowise Reflect version 1.0.9 contains a remote keystroke in… | CVSS 9.8 CRITICAL

Description

Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, opening applications and typing arbitrary text by sending specific WebSocket messages.

Metadata

CVE ID: CVE-2022-50925
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-01-11 13:34 UTC
Published: 2026-01-13 22:51 UTC
Last updated: 2026-04-07 14:06 UTC
Primary CWE: CWE-346
Origin Validation Error
Vendor / Product: Prowise / Prowise Reflect
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Prowise	Prowise Reflect	—	V1.0.9

Weakness (CWE)

CWE	Source	Description
CWE-346	cna	Origin Validation Error

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.6	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-50796 https://www.exploit-db.com/exploits/50796
Prowise Official Homepage https://www.prowise.com/
VulnCheck Advisory: Prowise Reflect v1.0.9 - Remote Keystroke Injection https://www.vulncheck.com/advisories/prowise-reflect-remote-keystroke-injection