PT-2025-48391
CVE-2025-13789
·
Published
2025-11-30
·
Updated
2026-10-18
Description by
CVSS 3.1
6.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
ZenTao versions up to 21.7.6-8564
Description
A server-side request forgery condition exists in ZenTao. The issue is related to the
makeRequest function within the module/ai/model.php file. Manipulation of the Base argument can trigger the issue. The attack can be launched remotely. The exploit has been made public.Recommendations
Upgrade to version 21.7.6 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾