CVE-2025-10764: SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery
A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10764?
CVE-2025-10764 is classified as a high severity vulnerability due to its potential to enable server-side request forgery.
How do I fix CVE-2025-10764?
To remediate CVE-2025-10764, it is recommended to update SeriaWei ZKEACMS to version 4.4 or later, which addresses this vulnerability.
What systems are affected by CVE-2025-10764?
CVE-2025-10764 affects SeriaWei ZKEACMS versions up to and including 4.3.
What type of vulnerability is CVE-2025-10764?
CVE-2025-10764 is a server-side request forgery vulnerability caused by improper handling of input arguments.
Who is the vendor for the affected software in CVE-2025-10764?
The vendor for the affected software in CVE-2025-10764 is SeriaWei, with the product being ZKEACMS.