CVE-2025-68645
🗓️ 22 Dec 2025 00:00:00Reported by mitreType 
cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 404 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 30 |
|---|---|---|---|---|
 | Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 10 Feb 202604:28 | – | githubexploit |
| Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 21 Feb 202614:07 | – | githubexploit |
| Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 7 Aug 202617:47 | – | githubexploit |
| Exploit for CVE-2025-68645 | 1 Jan 202610:29 | – | githubexploit |
| Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite | 6 May 202607:21 | – | githubexploit |
 | RestFilter Component Code Execution | 26 Dec 202500:00 | – | bdu_fstec |
 | CVE-2025-68645 | 25 Dec 202521:00 | – | circl |
 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 22 Jan 202600:00 | – | cisa_kev |
 | CISA Adds Four Known Exploited Vulnerabilities to Catalog | 22 Jan 202612:00 | – | cisa |
 | Zimbra Collaboration security vulnerabilities | 22 Dec 202500:00 | – | cnnvd |
10
Node
OR
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| javax.servlet.include.servlet_path | query param | /h/rest | LFI vulnerability in the RestFilter servlet allowing inclusion of arbitrary files from the WebRoot directory via the javax.servlet.include.servlet_path parameter. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printconversations | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the printconversations endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printcalendar | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the printcalendar endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/changepass | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the changepass endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/imessage | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the imessage endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/postLoginRedirect | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the postLoginRedirect endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printcalls | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the printcalls endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printvoicemails | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the printvoicemails endpoint. | CWE-98 |
| javax.servlet.include.servlet_path | query param | /h/printappointments | LFI vulnerability via the javax.servlet.include.servlet_path parameter on the printappointments endpoint. | CWE-98 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Nov 2026 22:10Current
8High risk
Vulners AI Score8
CVSS 3.18.8
EPSS0.50572
SSVC