CVE-2025-13787

Katalog CVE

CVSS 9.1 · Critical EPSS 0,38%

Kerentanan Incorrect Privilege Assignment pada zentao. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component.

Rincian

Terbit di NVD

30 November 2025

Terakhir diubah

3 September 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-269: Improper Privilege Management

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ez-lbz/ez-lbz.github.io/issues/1 exploit · issue tracking · advisory pihak ketiga
• https://github.com/ez-lbz/ez-lbz.github.io/issues/1#issuecomment-3540423868 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.333791 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.689892 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.333791 permissions required · vdb entry
• https://www.zentao.net/extension-buyext-1601-download.html product