https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-04T18:16:47.346122+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-114391 CVE-2026-114391 — ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods 2026-11-04T18:16:47.348215+00:00

Affected: easysoft zentaopms

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.