Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: easysoft Clear all filters
TI-2026-83119 CVE-2026-119645 · GHSA-j826-m6j5-hvhv

Missing authorization in ZenTao PMS lets users read private documents

Priority LOW 31

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00388 Published 2026-10-30 No fix listed CWE-639
TI-2026-78772 CVE-2026-114391 · GHSA-crpg-r4ww-5jx4

ZenTao PMS Authorization Bypass via Ajax Controller Methods

Priority LOW 31

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00299 Published 2026-10-21 Fixed in 22.3 CWE-863
TI-2026-75080 CVE-2026-111346

ZenTao PMS Authorization Bypass via action::editComment

Priority MEDIUM 57

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-10-15 No fix listed CWE-639