CVE-2022-39026: Edetw U-Office Force

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform XSS (Stored Cross-Site Scripting) attack.

Affected products

• Edetw U-Office Force: up to and including 20.50.7821d

Published 2022-10-31. Last modified 2026-06-17.