EasySoft has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.4 (medium). Most affected products: zentaopms (3), ZenTao PMS (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-111346Medium· 5.4ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID42CVE-2026-114391High· 7.1ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods39CVE-2026-119645Medium· 6.5ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc36CVE-2026-121514Medium· 6.3EasySoft ZenTao PMS User model.php checkGroupChange privileges management35
EasySoft vulnerabilities
CVEs affecting EasySoft, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-121514Medium· 6.3EasySoft ZenTao PMS User model.php checkGroupChange privileges management
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improp…
CVE-2026-119645Medium· 6.5ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document…
CVE-2026-114391High· 7.1ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like ta…
CVE-2026-111346Medium· 5.4PoCZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequentia…