CVE Watch—

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVSS

—

Sin CVSS

EPSS

1.8%

p75

KEV

SÍ

20 abr 2026

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

1.8%EPSS · 30 días1.8%

2026-06-302026-07-17

Ficha del catálogo KEV

Producto

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerabilidad

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Añadido a KEV

20 abr 2026

Remediar antes de

23 abr 2026

Uso conocido en ransomware

Descripción resumida

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2024-45519—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability—CVE-2019-9670—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference—CVE-2022-27925—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-41352—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-37042—

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability—CVE-2022-27924—

99.7%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability—