PT-2026-3539 · Unknown · Bjskzy Zhiyou Erp

Dptcc · Publicado 2026-01-20 · Atualizado 2026-01-20 · CVE-2026-1218

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0

Description A flaw exists in Bjskzy Zhiyou ERP that allows for xml external entity reference manipulation. This issue is present in the initRCForm function within the RichClientService.class file of the com.artery.richclient.RichClientService component. The attack can be carried out remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 11.0 should be updated. As a temporary workaround, consider restricting access to the RichClientService component to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

CWE-610

Identificadores relacionados

CVE-2026-1218

Produtos afetados

Bjskzy Zhiyou Erp

Referências · 8

• 🔥 https://github.com/dingpotian/cve-vul/blob/main/Shikong-Zhiyou-ERP/Shikong-Zhiyou-ERP-XXE-RichClientService-initRCForm.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1218 · Nota de Segurança
• https://vuldb.com/?id.341908 · Nota
• https://vuldb.com/?submit.735201 · Nota
• https://twitter.com/vuldb/status/2013734803410165779 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2013552126526439656 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013490574590959920 · Publicação no Twitter
• https://vuldb.com/?ctiid.341908 · Nota