XML External Entity Reference Vulnerability in Bjskzy Zhiyou ERP by Bjskzy
CVE-2026-1218

5.3MEDIUM

Key Information:

Vendor

Bjskzy

Status
Zhiyou Erp
Vendor
CVE Published:
20 January 2026

What is CVE-2026-1218?

A vulnerability exists in Bjskzy Zhiyou ERP, specifically in the initRCForm function of the RichClientService.class component. This flaw allows for the exploitation of XML external entity references, which could potentially enable remote attackers to manipulate data or access sensitive information. The issue impacts versions up to 11.0 of Bjskzy Zhiyou ERP. Despite early disclosure to the vendor, no response has been provided regarding the matter, and the exploit is now available publicly.

Affected Version(s)

Zhiyou ERP 11.0

References

https://vuldb.com/?id.341908
vdb-entrytechnical-description
https://vuldb.com/?ctiid.341908
signaturepermissions-required
https://vuldb.com/?submit.735201
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dptcc (VulDB User)
.