CVE-2022-32171CWE-79

Zinc - Stored XSS

published October 6, 2022

CVSS
—
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00658 · 50.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-10-06T17:14Z
EPSS history
Timeline
  • 06 OCT 17:14Z
    Zinc - Stored XSS
    cvelistv5