CVE-2022-50902 HIGH

CVE-2022-50902: Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path

Vendor Wondershare

Product Wondershare FamiSafe

Weakness CWE-91 · XML injection

Published January 13, 2026

Last update January 14, 2026

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Wondershare\FamiSafe\ to inject malicious code that would run with LocalSystem permissions during service startup.

Key dates

02Disclosure timeline

January 13, 2026 CVE published

January 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-50902 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/91.html

Related vulnerabilities

04Related CVE

CVE-2026-28770 XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101 CVE-2023-38207 Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read CVE-2026-41675 xmldom: XML node injection through unvalidated processing instruction serialization CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution CVE-2021-21019 Magento Commerce XML Injection Could Lead To Remote Code Execution