CVE-2022-32171
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality.
Does this matter?
Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.
Description
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
- CVSS
- Not yet scored
- EPSS
- 0.66% probability · 51th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- zinclabs/zinc
- Source
- vulnerabilitylab@mend.io
EPSS 0.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/zinclabs/zinc/commit/3376c248bade163430f9347742428f0a82cd322dPatch, Third Party Advisory
- https://www.mend.io/vulnerability-database/CVE-2022-32171Third Party Advisory
- https://github.com/zinclabs/zinc/commit/3376c248bade163430f9347742428f0a82cd322dPatch, Third Party Advisory
- https://www.mend.io/vulnerability-database/CVE-2022-32171Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.