Is there a public PoC exploit available for CVE-2026-16449?

Yes, a public proof-of-concept exploit is available for CVE-2026-16449. Prioritise patching immediately. EPSS: 0.3%.

ZS-Admin CVE-2026-16449

Q: What is the CVSS score of CVE-2026-16449?

CVE-2026-16449 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46276 LOW

SQL Injection (CWE-89)

2026-07-21 VulDB

GHSA-q7m3-2546-c4w2

SQLi Zs Admin Zsadmin2025

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L required for authenticated session; S:U as no scope change indicated; C/I/A Low reflects partial DB access typical of ORDER BY injection without confirmed full extraction.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 21, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jul 21, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 21, 2026 - 15:47 vuln.today

CVE Published

Jul 21, 2026 - 14:45 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in ZS-Admin (zsadmin2025) exposes authenticated remote attackers to database manipulation via the orderField parameter in the department pagination API. The vulnerable sorting functions OrderItem.asc and OrderItem.desc in SysDeptController accept unsanitized input and construct ORDER BY clauses through string concatenation, enabling injection against all instances up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. A public exploit has been disclosed through the project's own GitHub issue tracker, and no vendor response or patch has been issued at time of analysis.

Technical ContextAI

ZS-Admin is a Java-based administrative framework (package com.zs.sys.dept.controller.SysDeptController) following an MVC controller pattern. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: the orderField argument supplied by the client is passed directly into a dynamic ORDER BY clause via the OrderItem.asc and OrderItem.desc utility functions without parameterization or allowlist validation. ORDER BY injection is a specific and commonly overlooked SQL injection variant - because parameterized queries cannot be used for ORDER BY direction and column names in most SQL dialects, developers must validate against an explicit allowlist. Failure to do so allows attackers to inject arbitrary SQL expressions. The affected endpoint is /api/system/sys/dept/page, responsible for department listing with sort functionality. Affected CPE: cpe:2.3:a:zsadmin2025:zs-admin:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer was notified via a GitHub issue but has not responded. Operators should monitor https://github.com/zsadmin2025/zs-admin-java for commits that remediate the orderField parameter handling in SysDeptController. As an immediate compensating control, restrict access to the /api/system/sys/dept/page endpoint to the smallest possible set of trusted administrative accounts, reducing the attack surface by limiting who can supply the orderField parameter. Deploying a WAF rule targeting ORDER BY injection patterns (e.g., blocking SQL keywords such as SLEEP, BENCHMARK, UNION, or comment sequences in the orderField value) can further reduce exposure, though aggressive rules may block legitimate sort requests and should be validated against normal usage first. The correct long-term fix is to replace dynamic ORDER BY construction with an explicit allowlist of permitted column names validated server-side - this can be applied as a local patch to the SysDeptController pending upstream action.