Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Oct 21, 2026ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for aCVE-2026-114391 · Other software · easysoft · reported by VulnCheckHigh 7.1
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
- Product
- zentaopms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users'CVE-2026-111346 · Other software · easysoft · reported by VulnCheckMedium 5.3
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
- Product
- zentaopms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php.CVE-2025-50857 · Other software · reported by MITRECritical 9.8
ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 16, 2026A vulnerability was identified in ZenTao up to 21.7.8.CVE-2026-2552 · Other software · Zentao · reported by VulDBMedium 5.1
A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was determined in ZenTao up to 21.7.8.CVE-2026-2551 · Other software · Zentao · reported by VulDBLow 2.1
A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026A weakness has been identified in ZenTao up to 21.7.6-85642.CVE-2026-1884 · Other software · Zentao · reported by VulDBLow 2
A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/webhook/model.php of the component Webhook Module. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025A vulnerability was found in ZenTao up to 21.7.6-8564.CVE-2025-13789 · Other software · Zentao · reported by VulDBLow 2.1
A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6 mitigates this issue. It is suggested to upgrade the affected component.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025A flaw has been found in ZenTao up to 21.7.6-8564.CVE-2025-13787 · Other software · Zentao · reported by VulDBMedium 5.3
A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in theCVE-2022-4984 · Other software · Qingdao Esoft Tianchuang Network Technology Co., Ltd. · reported by VulnCheckHigh 8.7
ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database query. A remote unauthenticated attacker can exploit this issue to execute crafted SQL expressions and retrieve sensitive information from the backend database, including user and application data. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.
- Product
- ZenTao Biz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnvd.org.cnvulncheck.com
May 23, 2025A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical.CVE-2025-5114 · Other software · easysoft · reported by VulDBMedium 5.3
A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- zentaopms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.phpCVE-2024-24216 · Other software · Easycorp · reported by MITRECritical 9.8
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to exCVE-2024-24202 · Other software · easycorp · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
- Product
- zentao_max
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclammy-blizzard-8ef.notion.siteclammy-blizzard-8ef.notion.site
Jan 10, 2024Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.CVE-2023-49394 · Other software · Easycorp · reported by MITREMedium 6.1
Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnarrow-payment-2cd.notion.site
Nov 30, 2023A vulnerability classified as problematic was found in ZenTao PMS 18.8.CVE-2023-6439 · Other software · Easycorp · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246439.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can injeCVE-2023-46475 · Other software · Easycorp · reported by MITREMedium 5.4
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.CVE-2023-46376 · Other software · Zentao · reported by MITREHigh 7.5
Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 26, 2023ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-46375 · Other software · Zentao · reported by MITREHigh 8.8
ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 26, 2023ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.CVE-2023-46491 · Other software · Zentao · reported by MITREMedium 6.1
ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforemost-smash-52a.notion.siteforemost-smash-52a.notion.site
Oct 26, 2023ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).CVE-2023-46374 · Other software · Zentao · reported by MITREMedium 6.1
ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 9, 2023An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code viCVE-2023-44827 · Other software · Easycorp · reported by MITREHigh 8.8
An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspotted-topaz-6aa.notion.sitespotted-topaz-6aa.notion.site
Oct 9, 2023Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.CVE-2023-44826 · Other software · Easycorp · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.CVE-2020-21268 · Other software · Easycorp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameterCVE-2020-22533 · Other software · Easycorp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection.CVE-2022-47745 · Other software · Easycorp · reported by MITREHigh 8.8
ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to function importNotice.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Zentao Demo15 is vulnerable to Directory Traversal.CVE-2022-37700 · Other software · Easycorp · reported by MITREHigh 7.5
Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddemo15.zentao.pmmedium.com
Aug 30, 2021A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creatorCVE-2021-27558 · Other software · Easycorp · reported by MITREMedium 6.1
A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivasec.comprivasec.com
Aug 30, 2021A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.CVE-2021-27557 · Other software · Easycorp · reported by MITREMedium 4.3
A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivasec.comprivasec.com
Aug 30, 2021The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.CVE-2021-27556 · Other software · Easycorp · reported by MITREHigh 7.2
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivasec.comprivasec.com
Aug 12, 2021The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability.CVE-2020-28165 · Other software · Easycorp · reported by MITRECritical 9.8
The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2020The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component.CVE-2020-7361 · Other software · EasyCorp · reported by cve@rapid7.comCritical 9.6
The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.
- Product
- ZenTao Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2019An issue was discovered in ZenTao 11.5.1.CVE-2019-14731 · Other software · Cnezsoft · reported by MITREMedium 5.4
An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cookies via the Rich Text Box.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.