SeriaWei ZKEACMS vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting SeriaWei ZKEACMS: 2 record(s), with affected versions and fixes.
CVE-2026-111633
High · 8.6
CWE-321 Oct 16, 2026
ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
CVE-2025-11272
Medium · 5.4
CWE-266 Oct 4, 2025
SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.