CVE-2026-16449

Name of the Vulnerable Software and Affected Versions zsadmin2025 ZS-Admin versions up to b52e14536d59fda11e56e2536a1c32e82a38cead

Description A remote SQL injection is possible due to the improper handling of the orderField argument. The issue resides within the OrderItem.asc/OrderItem.desc function of the com.zs.sys.dept.controller.SysDeptController component, specifically at the '/api/system/sys/dept/page' endpoint.

Recommendations As a temporary workaround, avoid using the orderField parameter in the '/api/system/sys/dept/page' endpoint until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.