Vulnerabilities

TI-2026-75419 CVE-2026-111633 · GHSA-4v4h-58rp-w43w

Authentication bypass in ZKEACMS via hard-coded JWT signing key

HIGH 77

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00439 Published 2026-10-16 No fix listed CWE-321

TI-2025-10320 CVE-2025-11272 · GHSA-6768-v96h-wm7c

SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization

MEDIUM 59

A vulnerability has been found in SeriaWei ZKEACMS up to 4.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00291 Published 2025-10-04 No fix listed CWE-266

TI-2025-09857 CVE-2025-10766 · GHSA-p2xw-7rhr-fgrm

SeriaWei ZKEACMS EventViewerController.cs Download path traversal

MEDIUM 57

A weakness has been identified in SeriaWei ZKEACMS up to 4.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00563 Published 2025-09-21 No fix listed CWE-22

TI-2025-09856 CVE-2025-10765 · GHSA-j429-5xwx-mjx2

SeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgery

MEDIUM 56

A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00387 Published 2025-09-21 No fix listed CWE-918

TI-2025-09855 CVE-2025-10764 · GHSA-xj6v-gr3v-5fpq

SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery

MEDIUM 57

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00456 Published 2025-09-21 No fix listed CWE-918

TI-2025-09600 CVE-2025-10471 · GHSA-f4w7-4mq2-vxrx

ZKEACMS MediaController.cs Proxy server-side request forgery

LOW 24

A vulnerability was detected in ZKEACMS 4.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00314 Published 2025-09-15 No fix listed CWE-918

TI-2025-32515 CVE-2025-52239 · GHSA-q4h7-9j45-w69m

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.

HIGH 82

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00516 Published 2025-08-04 No fix listed CWE-434

TI-2022-11857 CVE-2022-29362 · GHSA-hc72-vj3g-5g2g

A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS…

LOW 25

A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00493 Published 2022-05-25 No fix listed CWE-79

TI-2020-13904 CVE-2020-20670 · GHSA-w2gx-ph96-cxcc

An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows…

MEDIUM 42

An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01747 Published 2021-09-13 No fix listed CWE-434

Vulnerabilities

Filters