Vulnerability · Published Feb 1, 2026 · Assigned by VulnCheck
CVE-2022-50942Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener
Medium 5.4
In plain English
A medium-severity cross-site scripting in Incinga Web from Incinga. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 75.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | icingaweb2 | no fix listed | DEBIAN-CVE-2022-50942 |
| Debian:13 | icingaweb2 | no fix listed | DEBIAN-CVE-2022-50942 |
| Debian:14 | icingaweb2 | no fix listed | DEBIAN-CVE-2022-50942 |
| Ubuntu:22.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2022-50942 |
| Ubuntu:24.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2022-50942 |
| Ubuntu:25.10 | icingaweb2 | no fix listed | UBUNTU-CVE-2022-50942 |
| Ubuntu:26.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2022-50942 |
| Ubuntu:26.10 | icingaweb2 | no fix listed | UBUNTU-CVE-2022-50942 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Incinga | Incinga Web | 2.8.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- Vulnerability Lab Advisory exploit
- Product Homepage product
- Product Homepage product
- VulnCheck Advisory: Inciga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener third-party-advisory