PT-2026-3539 · Unknown · Bjskzy Zhiyou Erp

Dptcc · Published 2026-01-20 · Updated 2026-01-20 · CVE-2026-1218

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0

Description A flaw exists in Bjskzy Zhiyou ERP that allows for xml external entity reference manipulation. This issue is present in the initRCForm function within the RichClientService.class file of the com.artery.richclient.RichClientService component. The attack can be carried out remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 11.0 should be updated. As a temporary workaround, consider restricting access to the RichClientService component to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

CWE-610

Related Identifiers

CVE-2026-1218

Affected Products

Bjskzy Zhiyou Erp

References · 8

• 🔥 https://github.com/dingpotian/cve-vul/blob/main/Shikong-Zhiyou-ERP/Shikong-Zhiyou-ERP-XXE-RichClientService-initRCForm.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1218 · Security Note
• https://vuldb.com/?id.341908 · Note
• https://vuldb.com/?submit.735201 · Note
• https://twitter.com/vuldb/status/2013734803410165779 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013552126526439656 · Twitter Post
• https://twitter.com/CVEnew/status/2013490574590959920 · Twitter Post
• https://vuldb.com/?ctiid.341908 · Note