CVE-2026-2552

<= 21.7.8

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.ph

5.5MEDIUM

CVE-2026-2551

<= 21.7.8

A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/co

5.4MEDIUM

CVE-2026-1884

<= 21.7.6

A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/web

4.7MEDIUM

CVE-2025-13789

< 21.7.6

A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The

6.3MEDIUM

CVE-2025-13787

< 21.7.7

A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/contr

5.4MEDIUM

CVE-2025-5114

all versions

A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the func

6.3MEDIUM

CVE-2024-24216

>= 18.0 and <= 18.10

Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /ap

9.8CRITICAL

CVE-2024-24202

all versions

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Ma

9.8CRITICAL

CVE-2023-49394

<= 4.1.3

Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.

6.1MEDIUM

CVE-2023-6439

all versions

A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality

3.5LOW

CVE-2023-46475

all versions

A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field

5.4MEDIUM

CVE-2023-46376

<= 8.7

Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.

7.5HIGH

CVE-2023-46375

<= 4.1.3

ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).

8.8HIGH

CVE-2023-46491

<= 4.1.3

ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.

6.1MEDIUM

CVE-2023-46374

<= 4.1.3

ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).

6.1MEDIUM

CVE-2023-44827

<= 18.6

An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacke

8.8HIGH

CVE-2023-44826

all versions

Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted scrip

5.4MEDIUM

CVE-2020-21268

all versions

Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComm

6.1MEDIUM

CVE-2020-22533

all versions

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter

6.1MEDIUM

CVE-2022-47745

>= 16.4 and < 18.0

ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constr

8.8HIGH

CVE-2022-37700

all versions

Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL :

7.5HIGH

CVE-2021-27558

all versions

A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various a

6.1MEDIUM

CVE-2021-27557

all versions

A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fie

4.3MEDIUM

CVE-2021-27556

all versions

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting th

7.2HIGH

CVE-2020-28165

< 12.4.2

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary w

9.8CRITICAL

CVE-2019-14731

all versions

An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cooki

5.4MEDIUM