# CVE-2026-16449: zsadmin2025 ZS-Admin SQL injection in SysDeptController

Source: https://junglewise.ai/threats/cve-2026-16449-zsadmin2025-zs-admin-sql-injection-in-sysdeptcontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-16449 · Severity: medium · CVSS 6.3 · Published 2026-07-21

ZS-Admin, a Java-based administrative management system, contains a security flaw in its department management module. An authenticated user can manipulate database queries through the sorting parameters used in page views. This could allow an attacker to view sensitive database information or metadata that they are not authorized to see, potentially compromising the integrity of the system's data.

Technologies: [Zsadmin2025 ZS-Admin](https://junglewise.ai/threats/technologies/zs-admin). Vendors: [Zsadmin2025](https://junglewise.ai/threats/vendors/zsadmin2025).

## Quick answers

**Is CVE-2026-16449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16449 being exploited in the wild.

**How severe is CVE-2026-16449?** Medium severity, with a CVSS score of 6.3, published 21 July 2026.

**Which products and versions are affected?** Zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead.

**Is there a fix for CVE-2026-16449?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16449 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16449?** Check whether you run Zsadmin2025 ZS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in ZS-Admin's SysDeptController, specifically within the /api/system/sys/dept/page endpoint. The vulnerability is rooted in the PageInfo pagination component, which takes the user-supplied 'orderField' parameter and passes it directly to MyBatis-Plus OrderItem.asc() or OrderItem.desc() methods without proper whitelist validation. While the input undergoes a transformation to underline case, it remains unsanitized before being appended to the SQL ORDER BY clause. An authenticated attacker with 'sys:dept:page' permissions can inject SQL expressions (e.g., using updatexml or other functions) to extract database metadata or sensitive information. As of the advisory date, the project has not responded to the issue report.

## Affected products

- zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead

## Timeline

- 2026-06-15: disclosed: Issue reported on GitHub repository
- 2026-07-21: advisory: CVE published and NVD record created

## References

- [https://github.com/zsadmin2025/zs-admin-java/issues/4](https://github.com/zsadmin2025/zs-admin-java/issues/4)
- [https://vuldb.com/cve/CVE-2026-16449](https://vuldb.com/cve/CVE-2026-16449)
- [https://vuldb.com/submit/858790](https://vuldb.com/submit/858790)
- [https://vuldb.com/vuln/380828](https://vuldb.com/vuln/380828)
- [https://vuldb.com/vuln/380828/cti](https://vuldb.com/vuln/380828/cti)

## Related threats

- [zsadmin2025 ZS-Admin unrestricted file upload in SysFileController](https://junglewise.ai/threats/cve-2026-16451-zsadmin2025-zs-admin-unrestricted-file-upload-in)
- [zsadmin2025 ZS-Admin authorization bypass in MyBatis-Plus Tenant Plugin](https://junglewise.ai/threats/cve-2026-16450-zsadmin2025-zs-admin-authorization-bypass-in-mybatis-plus-tenant)