CVE Watch—

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVSS

—

Sem CVSS

EPSS

1.7%

p77

KEV

SIM

20 de abr. de 2026

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

1.7%EPSS · 30 dias1.7%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerabilidade

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Adicionado ao KEV

20 de abr. de 2026

Corrigir até

23 de abr. de 2026

Uso conhecido em ransomware

Não

Descrição resumida

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Ação necessária

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-735708.9 ALT

99.4%

KEV—80Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability74d CVE-2025-663767.2 ALT

97.5%

KEV—79Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability30d CVE-2022-413529.8 CRÍ

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability57d CVE-2022-370429.8 CRÍ

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability94d CVE-2022-279257.2 ALT

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability35d CVE-2022-279247.5 ALT

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability35d