Cross-site Scripting in ZKEACMS

MEDIO 5.4CVE-2022-29362 · GHSA-hc72-vj3g-5g2g · Published 25/05/2022 · updated 17/06/2026

In breve

CVE-2022-29362 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda ZKEACMS.Publisher, zkeacms (zkea).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.49%, superiore al 42.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
ZKEACMS.Publisher NuGet	`≤ 2.0.0`	No fix yet
zkeacms zkea	`= 3.5.2`	No fix yet

Description

A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-29362 · ADVISORY
SeriaWei/ZKEACMS · WEB
SeriaWei/ZKEACMS commit 833c546 · WEB
SeriaWei/ZKEACMS · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free