CVE-2026-125747

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

EUVD-2026-121229

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747 ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747

ZenTao PMS versions through 22.7 are vulnerable to a missing object-level authorization (IDOR) flaw in module/build/control.php. This vulnerability allows authenticated users with build privileges in any project to manipulate builds in projects they do not belong to by supplying sequential buildI...

CVE-2026-125747 ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747: easysoft zentaopms: ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that…

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

PT-2026-141743

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-93429

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guestsdocuments' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-93429

The VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions up to and including 1.8.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'guests[][][documents]' parameter. This allows unaut...

CVE-2026-93429 VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guestsdocuments' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

EUVD-2026-119167

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guestsdocuments' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by artuskg in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.8.17...

PT-2026-139447

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guestsdocuments' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-121514

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

EUVD-2026-116371

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

CVE-2026-121514

A weakness exists in EasySoft ZenTao PMS (up to version 22.6) within the User Module component. Specifically, the function userModel::checkGroupChange in the file module/user/model.php is susceptible to manipulation of the argument group, leading to improper privilege management . This vulnerabil...

CVE-2026-121514 EasySoft ZenTao PMS User model.php checkGroupChange privileges management

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645 ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...