Easycorp's vulnerability profile centers on a small but prominent portfolio of web-based project management and administrative platforms, particularly the Zentao suite and EasyAdmin products that serve organizations across development and operations. Vulnerabilities affecting the vendor skew toward serious outcomes with an elevated share reaching critical severity, and a moderate tendency toward public exploit availability; the recurring weakness classes—cross-site scripting, command injection, OS command injection, unrestricted file upload, and cross-site request forgery—reflect the input-handling and file-processing demands of web applications deployed in enterprise environments. Defenders should prioritize patches for internet-facing instances of these products and implement input validation and upload controls as compensating measures; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Easycorp over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-7361HIGH The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attac | Aug 6, 2020 | 8.8 | 40 | NO | YES |
CVE-2022-47745HIGH ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to functio | Jan 19, 2023 | 8.8 | 35 | NO | NO |
CVE-2022-37700HIGH Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.zentao.pm/user-login.ht | Sep 19, 2022 | 7.5 | 27 | NO | NO |
CVE-2024-24216CRITICAL Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php. | Feb 8, 2024 | 9.8 | 26 | NO | NO |
CVE-2024-24202CRITICAL An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code | Feb 8, 2024 | 9.8 | 26 | NO | NO |
CVE-2023-44827HIGH An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script t | Oct 10, 2023 | 8.8 | 25 | NO | NO |
CVE-2021-27556HIGH The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System. | Aug 31, 2021 | 7.2 | 25 | NO | NO |
CVE-2025-5114CRITICAL A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&f | May 23, 2025 | 9.1 | 24 | NO | NO |
CVE-2020-28165CRITICAL The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPack | Aug 12, 2021 | 9.8 | 24 | NO | NO |
CVE-2021-27558MEDIUM A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator. | Aug 31, 2021 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Easycorp.
Media articles that mention a CVE ID that affects a product developed by Easycorp — matched by CVE ID, not by vendor name.