CVE-2022-42974

CVE-2022-42974 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1 web application, specifically on the /file.bootloader.upload.html page. An attacker can inject malicious HTML or JavaScript into the filename parameter during a system update POST request, which is then stored and executed when other users access pages retrieving this content. Rated Medium with a CVSS score of 4.8, this vulnerability requires local access and user interaction (UI:R) for exploitation, leading to low impacts on confidentiality, integrity, and availability. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.