CVE Intelligence
Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

Severity
Clear

18 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-73570 High · 8.9 KEV High · 66 Public exploit CWE-78 Aug 13, 2026
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CVE-2025-66376 Medium · 6.1 KEV High · 53 CWE-79 Jan 5, 2026
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-68645 High · 8.8 KEV High · 66 Public exploit CWE-98 Dec 22, 2025
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
CVE-2025-48700 Medium · 6.1 KEV High · 50 CWE-79 Jun 23, 2025
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
CVE-2025-27915 Medium · 5.4 KEV High · 56 Public exploit CWE-79 Mar 12, 2025
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
CVE-2024-45519 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-78 Oct 2, 2024
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
CVE-2023-37580 Medium · 6.1 KEV High · 57 Public exploit CWE-79 Jul 31, 2023
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
CVE-2023-34192 Critical · 9.0 KEV High · 64 Public exploit CWE-79 Jul 6, 2023
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
CVE-2022-41352 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Sep 25, 2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
CVE-2022-37042 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Aug 12, 2022
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
CVE-2022-27924 High · 7.5 KEV Urgent · 73 Public exploit Ransomware CWE-74 Apr 20, 2022
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
CVE-2022-27925 High · 7.2 KEV Urgent · 89 Public exploit Ransomware CWE-22 Apr 20, 2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
CVE-2022-27926 Medium · 6.1 KEV High · 57 Public exploit CWE-79 Apr 20, 2022
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
CVE-2022-24682 Medium · 6.1 KEV High · 67 Public exploit Ransomware CWE-116 Feb 9, 2022
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CVE-2020-7796 Critical · 9.8 KEV High · 67 Public exploit CWE-918 Feb 18, 2020
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
CVE-2019-9670 Critical · 9.8 KEV Urgent · 93 Public exploit CWE-611 May 29, 2019
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2019-9621 High · 7.5 KEV Urgent · 79 Public exploit CWE-918 Apr 30, 2019
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVE-2018-6882 Medium · 6.1 KEV High · 67 Public exploit Ransomware CWE-79 Mar 27, 2018
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.