PT-2025-40780 · Seriawei · Zkeacms

Yu Bao · Published 2025-10-04 · Updated 2025-10-04 · CVE-2025-11272

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SeriaWei ZKEACMS versions up to 4.3

Description A flaw exists in the Delete function within the src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs file of the POST Request Handler component. This issue results in improper authorization, potentially allowing for remote exploitation. The exploit for this issue has been publicly disclosed. The vendor was informed of this disclosure but did not provide a response.

Recommendations Versions prior to 4.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-11272

Affected Products

Zkeacms

References · 8

• 🔥 https://github.com/August829/YU1/issues/4#issue-3420825660 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11272 · Security Note
• https://t.me/cveNotify/137393 · Telegram Post
• https://github.com/August829/YU1/issues/4 · Note
• https://vuldb.com/?id.327006 · Note
• https://vuldb.com/?submit.655842 · Note
• https://vuldb.com/?ctiid.327006 · Note
• https://t.me/CVEtracker/34154 · Telegram Post