CVE-2022-50694

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
SOUND4 Ltd.Impact/Pulse/FirstVersion 2: 1.1/2.15
SOUND4 Ltd.Impact/Pulse Eco1.16
SOUND4 Ltd.BigVoice41.2
SOUND4 Ltd.BigVoice21.30
SOUND4 Ltd.Stream1.1/2.4.29
Kantar MediaWM21.11

References

Timeline

Published
Dec 30, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-506957.5SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arCVE-2022-506969.8SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified throuCVE-2022-506977.8In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The cCVE-2022-50698In the Linux kernel, the following vulnerability has been resolved: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() CVE-2022-50699In the Linux kernel, the following vulnerability has been resolved: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_contexCVE-2022-507007.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeCVE-2022-507017.1In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host SDIO mCVE-2022-50702In the Linux kernel, the following vulnerability has been resolved: vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blCVE-2022-50703In the Linux kernel, the following vulnerability has been resolved: soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() There areCVE-2022-50704In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free during usb config switch In the procesCVE-2022-50705In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: defer fsnotify calls to task context We can't call these CVE-2022-50706In the Linux kernel, the following vulnerability has been resolved: net/ieee802154: don't warn zero-sized raw_sendmsg() syzbot is hitting
CVE-2022-50694: Critical severity, CVSS 9.8 | Vulnix