CVE-2022-32172

What it is

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

At a glance

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2022-10-06 18:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 04:46 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.7% in the next 30 days (EPSS).
• Severity: not scored yet.
• Fix: a patch or advisory is linked.

Details

Published

2022-10-06 18:16 UTC

Last modified

2026-06-17 04:46 UTC

Exploit probability

0.7% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Modified

Affected

• Zinclabs Zinc ≤ 0.3.1

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2022-32172.md and follow it. Check whether this project is affected by CVE-2022-32172. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge