What is CVE-2022-50925?

CVE-2022-50925 is a critical-severity vulnerability in Prowise Reflect, classified under Origin Validation Error. CVSS score: 9.8/10. Published 2026-01-13.

How severe is CVE-2022-50925?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Prowise Reflect

CVE-2022-50925

Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, opening applications and typing arbitrary text by sending specific WebSocket messages.

EPSS: 0.003 (26.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Prowise Reflect — versions V1.0.9
Prowise Reflect — versions 1.0.9

Weakness classification (CWE)

CWE-346 — Origin Validation Error

References

disclosure@vulncheck.com (Exploit, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2022-50925?: CVE-2022-50925 is a critical-severity vulnerability in Prowise Reflect, classified under Origin Validation Error. CVSS score: 9.8/10. Published 2026-01-13.
How severe is CVE-2022-50925?: Critical severity. CVSS v3 base score is 9.8 out of 10.