Zhiyou-Group Zhiyou Erp vulnerabilities

CVE-2025-11140 [CRITICAL] CWE-610 CVE-2025-11140: A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is th A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed remotely. The exploit is publicly available and might be

CVE-2025-11139 [CRITICAL] CWE-22 CVE-2025-11139: A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudi A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendo

CVE-2025-9391 [CRITICAL] CWE-74 CVE-2025-9391: A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the functi A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor wa