Medium 6.3Published Jul 21, 2026

CVE-2026-16449zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection

Updated under an hour ago (Oct 26, 2026, 6:20 PM ET)

Does this affect you?

It affects zsadmin2025 ZS-Admin. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for zsadmin2025 ZS-Admin

Exploited in the last 30 days

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS: 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Weakness (CWE): CWE-89, CWE-74
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Jul 22, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

zsadmin2025 ZS-Admin zsadmin2025:zs-admin	b52e14536d59fda11e56e2536a1c32e82a38cead	CNA record

References

References

https://vuldb.com/vuln/380828	vdb-entry, technical-description
https://vuldb.com/vuln/380828/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-16449	third-party-advisory
https://vuldb.com/submit/858790	third-party-advisory
https://github.com/zsadmin2025/zs-admin-java/issues/4	exploit, issue-tracking

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.