CVE-2022-32172CWE-79

Zinc - Cross-Site Scripting

published October 6, 2022

CVSS
—
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00658 · 50.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-10-06T17:13Z
EPSS history
Timeline
  • 06 OCT 17:13Z
    Zinc - Cross-Site Scripting
    cvelistv5