ZE
Product
Zentao
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 8Low 0
Watch
Add Zentao to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-24216 | 9.8 | Feb 8 | Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php Affected: 18.0 through 18.10 |
| CVE-2024-24202 | 9.8 | Feb 8 | An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary… Affected: 18.10 |
| CVE-2020-28165 | 9.8 | Aug 12 | The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability Affected: before 12.4.2 |
| CVE-2025-5114 | 9.1 | May 23 | easysoft zentaopms Editor index.php edit deserialization Affected: 21.5_2025-03-07 |
| CVE-2023-44827 | 8.8 | Oct 10 | An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script… Affected: through 18.6 |
| CVE-2022-47745 | 8.8 | Jan 19 | ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection Affected: 16.4 before 18.0; 18.0 |
| CVE-2022-37700 | 7.5 | Sep 19 | Zentao Demo15 is vulnerable to Directory Traversal Affected: 15.0 |
| CVE-2021-27556 | 7.2 | Aug 31 | The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System Affected: 12.5.3 |
| CVE-2023-49394 | 6.1 | Jan 10 | Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly Affected: through 4.1.3 |
| CVE-2023-6439 | 6.1 | Nov 30 | A vulnerability classified as problematic was found in ZenTao PMS 18.8 Affected: 18.8 |
| CVE-2020-21268 | 6.1 | Jun 20 | Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter Affected: 11.6.4 |
| CVE-2020-22533 | 6.1 | Apr 4 | Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter Affected: All versions, or not specified |
| CVE-2021-27558 | 6.1 | Aug 31 | A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator Affected: 12.5.3 |
| CVE-2023-46475 | 5.4 | Nov 2 | A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious… Affected: 18.3 |
| CVE-2023-44826 | 5.4 | Oct 10 | Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script Affected: 18.6 |
| CVE-2021-27557 | 4.3 | Aug 31 | A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job Affected: 12.5.3 |
Showing 16