Every CVESearch/Get API key

CVE-2022-32172

Zinc - Cross-Site Scripting

5.4 MediumFix available

CVE-2022-32172 is a medium vulnerability (CVSS 5.4) in Zinc, published October 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in github.com/zincsearch/zincsearch 0.3.2.

What does this mean?
Severity
5.4 MediumCVSS 3.1, GitHub Advisories
Exploit chance
0.66%EPSS, 52nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.3.2github.com/zincsearch/zincsearch +1 more

Description

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.66%Down 0.2 points since Oct 7, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/zincsearch/zincsearch
Go
0.1.9 up to 0.3.2
0.3.2
github.com/zinclabs/zinc
Go
0.1.9 up to 0.3.2
0.3.2

What each source reports

GitHub Advisories Score usedGHSA-7j6x-42mm-p7jm5.4

Zinc Cross-site Scripting vulnerability

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Record
GHSA-7j6x-42mm-p7jm
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

Zinc - Cross-Site Scripting

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Record
CVE-2022-32172
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-1990No score

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Record
EUVD-2023-1990
Updated
2026-11-03
NVDNo score

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Record
CVE-2022-32172
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-7j6x-42mm-p7jm5.4

Zinc Cross-site Scripting vulnerability

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Record
GHSA-7j6x-42mm-p7jm
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVNo score

Zinc - Cross-Site Scripting

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.

Record
CVE-2022-32172
Weakness
CWE-79
Updated
2026-11-02
OSVGO-2023-1896No score

Zinc Cross-site Scripting vulnerability in github.com/zinclabs/zinc

Zinc Cross-site Scripting vulnerability in github.com/zinclabs/zinc

Record
GO-2023-1896
Updated
2026-11-02

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open