CVE-2022-48111

MediumCVSS 6.1

Published: 10/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.64%

46th percentile - higher than 46% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 versions 8 through 11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.

Risk Assessment

The risk for the organization includes session hijacking, account takeover, and leakage of sensitive data through malicious script execution in victims' browsers.

Recommendation

Immediately update WI400 to a version outside the affected range (above version 11) and implement input validation and encoding for the f parameter.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.