CVE Watch2 oct 2026

CVE-2022-27924

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

CVSS

7.5

Alto

EPSS

93.9%

p100

KEV

SÍ

4 ago 2022

Exploit Today

0-100

Publicado: 21 abr 2022 · Última mod.: 2 oct 2026 · CWE-74

EPSS · 30d

85.4%EPSS · 30 días93.9%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerabilidad

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Añadido a KEV

4 ago 2022

Remediar antes de

25 ago 2022

Uso conocido en ransomware

Sí

Descripción resumida

Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.

Acción requerida

Apply updates per vendor instructions.

Notas

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24.1#Security_Fixes; https://nvd.nist.gov/vuln/detail/CVE-2022-27924

Descripción técnica

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-815348.8 ALT

—

———The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.6h CVE-2026-1106707.3 ALT

—

——0A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.16h CVE-2026-1106687.3 ALT

—

——0A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.17h CVE-2026-973155.4 MED

—

——0The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.21h CVE-2026-880948.1 ALT

49.2%

——15Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.2d CVE-2026-1096207.3 ALT

33.9%

——10A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.21h