CVE-2022-29362

Name of the Vulnerable Software and Affected Versions ZKEACMS version 3.5.2

Description A cross-site scripting (XSS) issue exists in the /navigation/create?ParentID=%23 endpoint of ZKEACMS, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.

Recommendations For ZKEACMS version 3.5.2, consider disabling access to the /navigation/create?ParentID=%23 endpoint until a patch is available. As a temporary workaround, restrict the use of the ParentID parameter in this endpoint to minimize the risk of exploitation.