CVE-2026-16449
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In ZS-Admin up to version b52e14536d59fda11e56e2536a1c32e82a38cead, the function OrderItem.asc/OrderItem.desc in file /api/system/sys/dept/page of component com.zs.sys.dept.controller.SysDeptController is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be carried out remotely. The exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or database deletion.
Recommendation
Apply available patches immediately or temporarily disable the sorting functionality. Review the code for other SQL injection vulnerabilities.
Other vulnerabilities in ZS-Admin
See all- CVE-2026-16451Medium
Unrestricted file upload vulnerability in ZS-Admin up to version b52e145. An unknown function in /api/system/file/upload in the SysFileController component does not restrict the uploaded file type, allowing remote upload of arbitrary files. The exploit is public.
- CVE-2026-16450Medium
Vulnerability in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The getTenantId function in /api/system/sys/dept/page of the MyBatis-Plus Tenant Plugin allows authorization bypass via manipulation of the X-Tenant-Id argument. Remote attack, exploit publicly available.
Original NVD description (English source)
A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.