CVE-2025-11140

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0

Description A flaw exists in Bjskzy Zhiyou ERP that could allow for remote manipulation. The issue is related to the openForm function within the com.artery.richclient.RichClientService component. Specifically, manipulating the contentString argument can lead to xml external entity reference. The exploit is publicly available.

Recommendations Update to a version of Bjskzy Zhiyou ERP greater than 11.0. As a temporary workaround, consider restricting access to the openForm function until a patch is available.