zentaopms vulnerabilities

2 known vulnerabilities in zentaopms from EasySoft. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  zentaopms: Incorrect Authorization

  CVE-2026-114391Oct 21, 2026EasySoft

  ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.

• 9.1 Critical severity

  zentaopms: Deserialization of Untrusted Data

  CVE-2025-5114May 23, 2025EasySoft

  A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The man