PT-2026-29446 · Unknown · Z-9527 Admin

Vuldb · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-5251

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions z-9527 admin versions 1.0 through 2.0

Description A flaw exists in z-9527 admin versions 1.0 through 2.0 within the User Update Endpoint component, specifically affecting an unknown function in the /server/routes/user.js file. Manipulation of the isAdmin argument with the input 1 results in dynamically-determined object attributes. This issue is remotely exploitable, and an exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 2.0 should be updated. As a temporary workaround, consider restricting access to the /server/routes/user.js file or disabling the affected function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-915

CWE-913

Related Identifiers

CVE-2026-5251

Affected Products

Z-9527 Admin

References · 8

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5251 · Security Note
• https://vuldb.com/submit/780607 · Note
• https://vuldb.com/vuln/354441/cti · Note
• https://vuldb.com/vuln/354441 · Note
• https://twitter.com/CVEarity/status/2039318284743692670 · Twitter Post
• https://twitter.com/cyberbivash/status/2039182617359049028 · Twitter Post
• https://twitter.com/CVEnew/status/2039279682173247939 · Twitter Post