CVE-2020-28165

CRITICAL

EasyCorp ZenTao < 12.4.2 - Arbitrary File Upload via downloadZipPackage()

Title source: llm
STIX 2.1

Description

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0109
EPSS Percentile 61.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
easycorp/zentao < 12.4.2
Published Aug 12, 2021
Tracked Since Feb 18, 2026