Read the docs

easysoft

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

easysoft records in CISA KEV

No easysoft vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-75080 CVE-2026-111346

ZenTao PMS Authorization Bypass via action::editComment

Priority MEDIUM 57

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-10-15 No fix listed CWE-639
TI-2026-83119 CVE-2026-119645 · GHSA-j826-m6j5-hvhv

Missing authorization in ZenTao PMS lets users read private documents

Priority LOW 31

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00388 Published 2026-10-30 No fix listed CWE-639
TI-2026-78772 CVE-2026-114391 · GHSA-crpg-r4ww-5jx4

ZenTao PMS Authorization Bypass via Ajax Controller Methods

Priority LOW 31

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00299 Published 2026-10-21 Fixed in 22.3 CWE-863
Open these records in search →