easysoft zentaopms vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 5.3CVE-2026-125747EPSS 0.2%2026-11-10

   ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any p…

2. 7.1CVE-2026-119645EPSS 0.4%2026-10-30

   ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document i…

3. 7.1CVE-2026-114391EPSS 0.3%2026-10-21

   ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task…

4. 5.3CVE-2026-111346EPSS 0.2%2026-10-15

   ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential …