CVE Watch—

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVSS

—

No CVSS

EPSS

1.8%

p75

KEV

YES

Apr 20, 2026

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

1.8%EPSS · 30 days1.8%

2026-06-302026-07-17

KEV catalog record

Product

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Added to KEV

Apr 20, 2026

Remediate by

Apr 23, 2026

Known ransomware use

Summary description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-45519—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability—CVE-2019-9670—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference—CVE-2022-27925—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-41352—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-37042—

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability—CVE-2022-27924—

99.7%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability—