Vulnerabilities

TI-2026-39016 CVE-2026-54087 · GHSA-8559-gwj3-q37r

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

LOW 33

EasyAdmin is a fast and modern admin generator for Symfony applications.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00404 Published 2026-09-14 Fixed in 5.0.13 CWE-434

TI-2026-56503 CVE-2026-81892 · GHSA-g2fm-8hr4-j82h

EasyAdmin custom-action dispatcher bypasses access_control on other routes

LOW 38

EasyAdmin is a fast and modern admin generator for Symfony applications.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00448 Published 2026-08-31 Fixed in 4.29.16, 5.5.1 CWE-639

TI-2025-04584 CVE-2025-5114 · GHSA-gvwq-4r92-cj5h

easysoft zentaopms Editor index.php edit deserialization

MEDIUM 57

A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00584 Published 2025-05-23 No fix listed CWE-20

TI-2024-02886 CVE-2024-3081 · GHSA-pprg-rj4x-j7w4

EasyCorp EasyAdmin Autocomplete autocomplete.js cross site scripting

LOW 25

A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00539 Published 2024-03-29 No fix listed CWE-79

TI-2024-16042 CVE-2024-24216 · GHSA-xf6f-94pc-55vc

Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE)…

HIGH 82

Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01274 Published 2024-02-08 No fix listed CWE-77

TI-2024-16039 CVE-2024-24202 · GHSA-c493-5mp7-c24q

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community…

HIGH 82

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01 Published 2024-02-08 No fix listed CWE-434

TI-2023-26980 CVE-2023-49394 · GHSA-85w5-mw69-5h72

Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.

MEDIUM 60

Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00374 Published 2024-01-10 No fix listed CWE-601

TI-2023-05909 CVE-2023-6439 · GHSA-hfqm-3jpv-59hp

ZenTao PMS cross site scripting

LOW 28

A vulnerability classified as problematic was found in ZenTao PMS 18.8.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00693 Published 2023-11-30 No fix listed CWE-79

TI-2023-25024 CVE-2023-46475 · GHSA-fpg9-4hq2-2j28

A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user…

MEDIUM 58

A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00478 Published 2023-11-02 No fix listed CWE-79

TI-2023-24012 CVE-2023-44827 · GHSA-f3fc-q7qp-8xqj

An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before…

HIGH 73

An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings functio…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01046 Published 2023-10-10 No fix listed CWE-77

TI-2023-24011 CVE-2023-44826 · GHSA-hqvg-7vm6-9j8v

Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain…

MEDIUM 58

Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00439 Published 2023-10-10 No fix listed CWE-79

TI-2020-14025 CVE-2020-21268 · GHSA-w2fg-vh2j-wmhr

Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker…

LOW 28

Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00565 Published 2023-06-20 No fix listed CWE-79

TI-2020-14347 CVE-2020-22533 · GHSA-q23x-8jfp-8j7q

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute…

MEDIUM 60

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00514 Published 2023-04-04 No fix listed CWE-79

TI-2022-23694 CVE-2022-47745 · GHSA-xr2p-f39w-cjpv

ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection.

HIGH 73

ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.15394 Published 2023-01-19 No fix listed CWE-89

TI-2022-17531 CVE-2022-37700 · GHSA-wmpj-9273-jv34

Zentao Demo15 is vulnerable to Directory Traversal.

LOW 39

Zentao Demo15 is vulnerable to Directory Traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03219 Published 2022-09-19 No fix listed CWE-22

TI-2021-09016 CVE-2021-27558 · GHSA-78qw-m224-h56g

A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to…

LOW 29

A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00838 Published 2021-08-31 No fix listed CWE-79

TI-2021-09015 CVE-2021-27557 · GHSA-q347-hg43-3wqc

A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao…

LOW 20

A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0036 Published 2021-08-31 No fix listed CWE-352

TI-2021-09014 CVE-2021-27556 · GHSA-w72j-vh4j-rfc3

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin…

LOW 38

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04009 Published 2021-08-31 No fix listed CWE-78

TI-2020-17117 CVE-2020-28165 · GHSA-p999-983h-mw4g

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload…

MEDIUM 44

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01087 Published 2021-08-12 No fix listed CWE-434

TI-2020-05953 CVE-2020-7361 · GHSA-6wcp-gj2x-5f4w

ZenTao Pro Command Injection

MEDIUM 58

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.17225 Published 2020-08-06 No fix listed CWE-78

Vulnerabilities

Filters