CVE-2026-129465

The Zr.Admin.NET application (commits af07ffc through eb9228a ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the SysProfileController.UpdateProfile function. This vulnerability allows any authenticated user to modify other accounts by manipulating the UserId parameter. An a...

EUVD-2026-125955

Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, reque...

CVE-2026-129465: izhaorui Zr.Admin.NET: Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in…

Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, reque...

PT-2026-147448

Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, reque...