Approved changes feed: RSS · Atom
cpe:2.3:a:zentao:zentao:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Zentao (d80bfca8-df25-5416-8e72-332da3b2d9c0) |
|---|---|
| Product | Zentao (e5e0d272-e053-53de-9c0a-2c34241c60e2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/easysoft/zentaopms |
purl2cpe | 2026-06-01 10:11:46.520183 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-2552 |
vulnerable | 2026-06-08 07:55:17.208770 |
ZenTao Editor control.php delete path traversal
MEDIUM (5.5)
A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.
Published: 2026-02-16T11:02:05.938Z
Updated: 2026-02-23T10:08:48.186Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2551 |
vulnerable | 2026-06-08 07:55:17.208114 |
ZenTao Backup control.php delete path traversal
MEDIUM (5.4)
A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-02-16T10:32:07.030Z
Updated: 2026-02-23T10:08:34.751Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1884 |
vulnerable | 2026-06-08 07:49:09.802782 |
ZenTao Webhook model.php fetchHook server-side request forgery
MEDIUM (4.7)
A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/webhook/model.php of the component Webhook Module. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-04T21:32:08.978Z
Updated: 2026-02-23T09:16:38.821Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13789 |
vulnerable | 2026-06-08 07:06:32.711133 |
ZenTao model.php makeRequest server-side request forgery
MEDIUM (6.3)
A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6 mitigates this issue. It is suggested to upgrade the affected component.
Published: 2025-11-30T13:32:16.964Z
Updated: 2025-12-01T15:48:42.607Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13787 |
vulnerable | 2026-06-08 07:06:32.708327 |
ZenTao File control.php delete privileges management
MEDIUM (5.4)
A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component.
Published: 2025-11-30T10:32:08.651Z
Updated: 2025-12-01T15:03:55.578Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.