CVE-2026-93636

An LDAP filter injection vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP...

CVE-2026-93636 Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name

An LDAP filter injection vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP...

CVE-2026-93636

Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to an LDAP filter injection vulnerability. The flaw exists because the application escapes search values but fails to validate supplied attribute names, inserting them directly into LDAP filter expressions during a Searc...

EUVD-2026-108975

An LDAP filter injection vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP...

PT-2026-122116

An LDAP filter injection vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP...