https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-11140.htmlhttps://patchthecve.com/cve/CVE-2025-11140.htmlFri, 09 Oct 2026 09:10:00 +0000HIGH 7.3: A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed remotelhttps://patchthecve.com/cve/CVE-2025-11139.htmlhttps://patchthecve.com/cve/CVE-2025-11139.htmlFri, 09 Oct 2026 09:10:00 +0000MEDIUM 6.3: A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has beenhttps://patchthecve.com/cve/CVE-2025-9391.htmlhttps://patchthecve.com/cve/CVE-2025-9391.htmlWed, 17 Jun 2026 10:08:52 +0000MEDIUM 6.3: A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made available