CVE-2025-68645
🗓️ 22 Dec 2025 00:00:00Reported by mitreType 
cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 367 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 30 |
|---|---|---|---|---|
 | Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 10 Feb 202604:28 | – | githubexploit |
| Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 21 Feb 202614:07 | – | githubexploit |
| Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 7 Aug 202617:47 | – | githubexploit |
| Exploit for CVE-2025-68645 | 1 Jan 202610:29 | – | githubexploit |
| Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 6 May 202607:21 | – | githubexploit |
 | RestFilter Component Code Execution | 26 Dec 202500:00 | – | bdu_fstec |
 | CVE-2025-68645 | 25 Dec 202521:00 | – | circl |
 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 22 Jan 202600:00 | – | cisa_kev |
 | CISA Adds Four Known Exploited Vulnerabilities to Catalog | 22 Jan 202612:00 | – | cisa |
 | Zimbra Collaboration 安全漏洞 | 22 Dec 202500:00 | – | cnnvd |
10
Node
OR
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| javax.servlet.include.servlet_path | query param | /h/rest?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via RestFilter allowing inclusion of internal files by manipulating javax.servlet.include.servlet_path in /h/rest. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printconversations?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via printconversations endpoint by manipulating javax.servlet.include.servlet_path to read WebRoot files. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/changepass?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via changepass endpoint using javax.servlet.include.servlet_path to access internal files. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/imessage?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via imessage endpoint by injecting include path to read WebRoot content. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printcalendar?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via printcalendar endpoint with manipulated include path to disclose internal files. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printvoicemails?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via printvoicemails endpoint using include_path parameter to access server files. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printappointments?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via printappointments endpoint by altering javax.servlet.include.servlet_path to reveal internal files. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/postLoginRedirect?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via postLoginRedirect endpoint with crafted include path to read WebRoot files. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printcalls?javax.servlet.include.servlet_path=/WEB-INF/web.xml | LFI via printcalls endpoint by manipulating include path to access internal files. | CWE-98 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 09:59Current
8.1High risk
Vulners AI Score8.1
CVSS 3.18.8
EPSS0.48873
SSVC