CVE-2022-29362

A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.

• CWE-79

• https://github.com/SeriaWei/ZKEACMS/issues/457Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/SeriaWei/ZKEACMS/issues/457Exploit, Issue Tracking, Patch, Third Party Advisory

Published

May 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29354An arbitrary file upload vulnerability in the file upload mo…9.8
• CVE-2022-29358epub2txt2 v2.04 was discovered to contain an integer overflo…5.5
• CVE-2022-29359A stored cross-site scripting (XSS) vulnerability in /scas/?…6.1
• CVE-2022-2936The Image Hover Effects Ultimate plugin for WordPress is vul…5.4
• CVE-2022-29360The Email Viewer in RainLoop through 1.6.0 allows XSS via a …5.4
• CVE-2022-29361Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0…9.8
• CVE-2022-29363Phpok v6.1 was discovered to contain a deserialization vulne…9.8
• CVE-2022-29368Moddable commit before 135aa9a4a6a9b49b60aa730ebc3bcc6247d75…7.1
• CVE-2022-29369Nginx NJS v0.7.2 was discovered to contain a segmentation vi…7.5
• CVE-2022-2937The Image Hover Effects Ultimate plugin for WordPress is vul…5.4
• CVE-2022-29376Xampp for Windows v8.1.4 and below was discovered to contain…8.8
• CVE-2022-29377Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to co…7.5