Search
Find a vulnerability
Search criteria
10 vulnerabilities by EasySoft
CVE-2026-121514 (GCVE-0-2026-121514)
Vulnerability from nvd – Published: 2026-11-03 20:45 – Updated: 2026-11-03 21:25
VLAI
EPSS
VEX
Title
EasySoft ZenTao PMS User model.php checkGroupChange privileges management
Summary
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 21:25 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430286 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430286/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121514 | third-party-advisory |
| https://vuldb.com/submit/1019652 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EasySoft | ZenTao PMS |
Affected:
22.0
Affected: 22.1 Affected: 22.2 Affected: 22.3 Affected: 22.4 Affected: 22.5 Affected: 22.6 cpe:2.3:a:easysoft:zentao_pms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121514",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T21:25:40.346360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T21:25:51.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:easysoft:zentao_pms:*:*:*:*:*:*:*:*"
],
"modules": [
"User Module"
],
"product": "ZenTao PMS",
"vendor": "EasySoft",
"versions": [
{
"status": "affected",
"version": "22.0"
},
{
"status": "affected",
"version": "22.1"
},
{
"status": "affected",
"version": "22.2"
},
{
"status": "affected",
"version": "22.3"
},
{
"status": "affected",
"version": "22.4"
},
{
"status": "affected",
"version": "22.5"
},
{
"status": "affected",
"version": "22.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "benjamin_123 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:45:16.516Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430286 | EasySoft ZenTao PMS User model.php checkGroupChange privileges management",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430286"
},
{
"name": "VDB-430286 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430286/cti"
},
{
"name": "CVE-2026-121514 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121514"
},
{
"name": "Submit #1019652 | ZenTao ZenTao PMS 22.6 Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019652"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:24:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "EasySoft ZenTao PMS User model.php checkGroupChange privileges management",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121514",
"datePublished": "2026-11-03T20:45:16.516Z",
"dateReserved": "2026-11-03T14:18:55.090Z",
"dateUpdated": "2026-11-03T21:25:51.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119645 (GCVE-0-2026-119645)
Vulnerability from nvd – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:53
VLAI
EPSS
VEX
Title
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
Summary
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/easysoft/zentaopms/issues/215 | issue-tracking |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://hackmd.io/@hieuPenguinnn/zentaopms-doc-aj… | third-party-advisory |
| https://github.com/easysoft/zentaopms | product |
| https://www.vulncheck.com/advisories/zentao-pms-t… | third-party-advisory |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:19.261386Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:53:14.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThanOrEqual": "22.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:09.559Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/easysoft/zentaopms/issues/215"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/doc/control.php#L2524-L2589"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/easysoft/zentaopms"
},
{
"name": "VulnCheck Advisory: ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc"
}
],
"title": "ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119645",
"datePublished": "2026-10-30T14:16:09.559Z",
"dateReserved": "2026-10-30T13:43:41.064Z",
"dateUpdated": "2026-10-30T15:53:14.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114391 (GCVE-0-2026-114391)
Vulnerability from nvd – Published: 2026-10-21 12:39 – Updated: 2026-10-21 20:08
VLAI
EPSS
VEX
Title
ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
Summary
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 20:07 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/easysoft/zentaopms/issues/181 | issue-tracking |
| https://github.com/easysoft/zentaopms/commit/ac48… | patch |
| https://github.com/easysoft/zentaopms/releases/ta… | release-notes |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://www.vulncheck.com/advisories/zentao-pms-b… | third-party-advisory |
Date Public
2026-02-25 19:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T20:07:52.585873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:08:00.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/easysoft/zentaopms",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThan": "22.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-25T19:34:12.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing \u0027ajax\u0027. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:47.378Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/easysoft/zentaopms/issues/181"
},
{
"tags": [
"patch"
],
"url": "https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49"
},
{
"name": "zentaopms zentaopms_22.3_20260707 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/easysoft/zentaopms/releases/tag/zentaopms_22.3_20260707"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php#L446-L463"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.php#L454-L474"
},
{
"name": "VulnCheck Advisory: ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-before-22.3-authorization-bypass-via-ajax-controller-methods"
}
],
"title": "ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114391",
"datePublished": "2026-10-21T12:39:47.378Z",
"dateReserved": "2026-10-21T11:46:41.926Z",
"dateUpdated": "2026-10-21T20:08:00.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111346 (GCVE-0-2026-111346)
Vulnerability from nvd – Published: 2026-10-15 21:43 – Updated: 2026-10-16 16:46
VLAI
EPSS
VEX
Title
ZenTao PMS through 22.6 Authorization Bypass via action::editComment
Summary
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:46 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/zentaopms-action… | third-party-advisory |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://github.com/easysoft/zentaopms | product |
| https://www.vulncheck.com/advisories/zentao-pms-t… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:46:07.691798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:46:31.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/easysoft/zentaopms",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThanOrEqual": "22.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users\u0027 comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:37.962Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057"
},
{
"tags": [
"product"
],
"url": "https://github.com/easysoft/zentaopms"
},
{
"name": "VulnCheck Advisory: ZenTao PMS through 22.6 Authorization Bypass via action::editComment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment"
}
],
"title": "ZenTao PMS through 22.6 Authorization Bypass via action::editComment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111346",
"datePublished": "2026-10-15T21:43:37.962Z",
"dateReserved": "2026-10-15T20:53:32.807Z",
"dateUpdated": "2026-10-16T16:46:31.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5114 (GCVE-0-2025-5114)
Vulnerability from nvd – Published: 2025-05-23 14:31 – Updated: 2025-05-23 14:41
VLAI
EPSS
VEX
Title
easysoft zentaopms Editor index.php edit deserialization
Summary
A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-23 14:41 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.310090 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.310090 | signaturepermissions-required |
| https://vuldb.com/?submit.570727 | third-party-advisory |
| https://github.com/3em0/cve_repo/blob/main/zentao… | related |
| https://github.com/3em0/cve_repo/blob/main/zentao… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5114",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-23T14:41:46.801280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-23T14:41:59.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Editor"
],
"product": "zentaopms",
"vendor": "easysoft",
"versions": [
{
"status": "affected",
"version": "21.5_20250307"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor\u0026f=edit\u0026filePath=cGhhcjovLy9ldGMvcGFzc3dk\u0026action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In easysoft zentaopms 21.5_20250307 wurde eine kritische Schwachstelle gefunden. Es geht um die Funktion Edit der Datei /index.php?m=editor\u0026f=edit\u0026filePath=cGhhcjovLy9ldGMvcGFzc3dk\u0026action=edit der Komponente Committer. Dank der Manipulation des Arguments filePath mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-23T14:31:04.924Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-310090 | easysoft zentaopms Editor index.php edit deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.310090"
},
{
"name": "VDB-310090 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.310090"
},
{
"name": "Submit #570727 | easysoft zentaopms 21.5_20250307 phar deserialization vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.570727"
},
{
"tags": [
"related"
],
"url": "https://github.com/3em0/cve_repo/blob/main/zentaopms/Phar%20Bypass%20Vulnerability%20in%20ZenTao.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/blob/main/zentaopms/Phar%20Bypass%20Vulnerability%20in%20ZenTao.md#exploitation"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-05-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-05-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-05-23T09:03:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "easysoft zentaopms Editor index.php edit deserialization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5114",
"datePublished": "2025-05-23T14:31:04.924Z",
"dateReserved": "2025-05-23T06:57:39.165Z",
"dateUpdated": "2025-05-23T14:41:59.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-121514 (GCVE-0-2026-121514)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:45 – Updated: 2026-11-03 21:25
VLAI
EPSS
VEX
Title
EasySoft ZenTao PMS User model.php checkGroupChange privileges management
Summary
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 21:25 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430286 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430286/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121514 | third-party-advisory |
| https://vuldb.com/submit/1019652 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EasySoft | ZenTao PMS |
Affected:
22.0
Affected: 22.1 Affected: 22.2 Affected: 22.3 Affected: 22.4 Affected: 22.5 Affected: 22.6 cpe:2.3:a:easysoft:zentao_pms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121514",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T21:25:40.346360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T21:25:51.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:easysoft:zentao_pms:*:*:*:*:*:*:*:*"
],
"modules": [
"User Module"
],
"product": "ZenTao PMS",
"vendor": "EasySoft",
"versions": [
{
"status": "affected",
"version": "22.0"
},
{
"status": "affected",
"version": "22.1"
},
{
"status": "affected",
"version": "22.2"
},
{
"status": "affected",
"version": "22.3"
},
{
"status": "affected",
"version": "22.4"
},
{
"status": "affected",
"version": "22.5"
},
{
"status": "affected",
"version": "22.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "benjamin_123 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:45:16.516Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430286 | EasySoft ZenTao PMS User model.php checkGroupChange privileges management",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430286"
},
{
"name": "VDB-430286 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430286/cti"
},
{
"name": "CVE-2026-121514 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121514"
},
{
"name": "Submit #1019652 | ZenTao ZenTao PMS 22.6 Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019652"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:24:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "EasySoft ZenTao PMS User model.php checkGroupChange privileges management",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121514",
"datePublished": "2026-11-03T20:45:16.516Z",
"dateReserved": "2026-11-03T14:18:55.090Z",
"dateUpdated": "2026-11-03T21:25:51.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119645 (GCVE-0-2026-119645)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:53
VLAI
EPSS
VEX
Title
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
Summary
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/easysoft/zentaopms/issues/215 | issue-tracking |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://hackmd.io/@hieuPenguinnn/zentaopms-doc-aj… | third-party-advisory |
| https://github.com/easysoft/zentaopms | product |
| https://www.vulncheck.com/advisories/zentao-pms-t… | third-party-advisory |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:19.261386Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:53:14.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThanOrEqual": "22.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:09.559Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/easysoft/zentaopms/issues/215"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/doc/control.php#L2524-L2589"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/easysoft/zentaopms"
},
{
"name": "VulnCheck Advisory: ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc"
}
],
"title": "ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119645",
"datePublished": "2026-10-30T14:16:09.559Z",
"dateReserved": "2026-10-30T13:43:41.064Z",
"dateUpdated": "2026-10-30T15:53:14.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114391 (GCVE-0-2026-114391)
Vulnerability from cvelistv5 – Published: 2026-10-21 12:39 – Updated: 2026-10-21 20:08
VLAI
EPSS
VEX
Title
ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
Summary
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 20:07 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/easysoft/zentaopms/issues/181 | issue-tracking |
| https://github.com/easysoft/zentaopms/commit/ac48… | patch |
| https://github.com/easysoft/zentaopms/releases/ta… | release-notes |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://www.vulncheck.com/advisories/zentao-pms-b… | third-party-advisory |
Date Public
2026-02-25 19:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T20:07:52.585873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:08:00.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/easysoft/zentaopms",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThan": "22.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-25T19:34:12.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing \u0027ajax\u0027. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:47.378Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/easysoft/zentaopms/issues/181"
},
{
"tags": [
"patch"
],
"url": "https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49"
},
{
"name": "zentaopms zentaopms_22.3_20260707 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/easysoft/zentaopms/releases/tag/zentaopms_22.3_20260707"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php#L446-L463"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.php#L454-L474"
},
{
"name": "VulnCheck Advisory: ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-before-22.3-authorization-bypass-via-ajax-controller-methods"
}
],
"title": "ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114391",
"datePublished": "2026-10-21T12:39:47.378Z",
"dateReserved": "2026-10-21T11:46:41.926Z",
"dateUpdated": "2026-10-21T20:08:00.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111346 (GCVE-0-2026-111346)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 16:46
VLAI
EPSS
VEX
Title
ZenTao PMS through 22.6 Authorization Bypass via action::editComment
Summary
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:46 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/zentaopms-action… | third-party-advisory |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://github.com/easysoft/zentaopms | product |
| https://www.vulncheck.com/advisories/zentao-pms-t… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:46:07.691798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:46:31.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/easysoft/zentaopms",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThanOrEqual": "22.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users\u0027 comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:37.962Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057"
},
{
"tags": [
"product"
],
"url": "https://github.com/easysoft/zentaopms"
},
{
"name": "VulnCheck Advisory: ZenTao PMS through 22.6 Authorization Bypass via action::editComment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment"
}
],
"title": "ZenTao PMS through 22.6 Authorization Bypass via action::editComment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111346",
"datePublished": "2026-10-15T21:43:37.962Z",
"dateReserved": "2026-10-15T20:53:32.807Z",
"dateUpdated": "2026-10-16T16:46:31.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5114 (GCVE-0-2025-5114)
Vulnerability from cvelistv5 – Published: 2025-05-23 14:31 – Updated: 2025-05-23 14:41
VLAI
EPSS
VEX
Title
easysoft zentaopms Editor index.php edit deserialization
Summary
A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-23 14:41 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.310090 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.310090 | signaturepermissions-required |
| https://vuldb.com/?submit.570727 | third-party-advisory |
| https://github.com/3em0/cve_repo/blob/main/zentao… | related |
| https://github.com/3em0/cve_repo/blob/main/zentao… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5114",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-23T14:41:46.801280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-23T14:41:59.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Editor"
],
"product": "zentaopms",
"vendor": "easysoft",
"versions": [
{
"status": "affected",
"version": "21.5_20250307"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor\u0026f=edit\u0026filePath=cGhhcjovLy9ldGMvcGFzc3dk\u0026action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In easysoft zentaopms 21.5_20250307 wurde eine kritische Schwachstelle gefunden. Es geht um die Funktion Edit der Datei /index.php?m=editor\u0026f=edit\u0026filePath=cGhhcjovLy9ldGMvcGFzc3dk\u0026action=edit der Komponente Committer. Dank der Manipulation des Arguments filePath mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-23T14:31:04.924Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-310090 | easysoft zentaopms Editor index.php edit deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.310090"
},
{
"name": "VDB-310090 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.310090"
},
{
"name": "Submit #570727 | easysoft zentaopms 21.5_20250307 phar deserialization vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.570727"
},
{
"tags": [
"related"
],
"url": "https://github.com/3em0/cve_repo/blob/main/zentaopms/Phar%20Bypass%20Vulnerability%20in%20ZenTao.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/blob/main/zentaopms/Phar%20Bypass%20Vulnerability%20in%20ZenTao.md#exploitation"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-05-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-05-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-05-23T09:03:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "easysoft zentaopms Editor index.php edit deserialization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5114",
"datePublished": "2025-05-23T14:31:04.924Z",
"dateReserved": "2025-05-23T06:57:39.165Z",
"dateUpdated": "2025-05-23T14:41:59.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}