EasyCorp vulnerabilities
We track 8 vulnerabilities in EasyCorp products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
Latest EasyCorp vulnerabilities
- 7.6 High severity
EasyAdminBundle: Improper Neutralization of Input During Web Page Generation
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering wi
- 8.1 High severity
EasyAdminBundle: Authorization Bypass Through User-Controlled Key
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swa
- 9.1 Critical severity
zentaopms: Deserialization of Untrusted Data
A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The man
- 9.8 Critical severity
Zentao: Improper Neutralization of Special Elements used in a Command
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
- 9.8 Critical severity
zentao_max: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
- 8.8 High severity
Zentao: Improper Neutralization of Special Elements used in a Command
An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
- 8.8 High severity
Zentao: Improper Neutralization of Special Elements used in an SQL Command
ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to function importNotice.
- 7.5 High severity
Zentao: Improper Limitation of a Pathname to a Restricted Directory
Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig.