{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-01T21:38:57.872","vulnerabilities":[{"cve":{"id":"CVE-2020-7361","sourceIdentifier":"cve@rapid7.com","published":"2020-08-06T16:15:13.750","lastModified":"2024-11-21T05:37:06.970","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system."},{"lang":"es","value":"La aplicación EasyCorp ZenTao Pro sufre de una vulnerabilidad de inyección de comandos de Sistema Operativo en su componente \"/pro/repo-create.html\". Después de autenticarse en el panel de control de ZenTao, los atacantes pueden construir y enviar comandos arbitrarios del Sistema Operativo por medio de la \"path\" del parámetro POST, y esos comandos se ejecutarán en un contexto SYSTEM elevado en el sistema operativo Windows subyacente"}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:easycorp:zentao_pro:*:*:*:*:*:*:*:*","versionEndIncluding":"8.8.2","matchCriteriaId":"AED31766-AA57-4A49-A35C-EF3B31BE1F8E"}]}]}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/13828","source":"cve@rapid7.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/13828","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}