17 matches found
CVE-2026-93641
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...
CVE-2026-93647
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...
EUVD-2026-87102
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...
EUVD-2026-87098
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...
CVE-2026-93647: Improper Neutralization of Input During Web Page Generation
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...
PT-2026-98863
Name of the Vulnerable Software and Affected Versions Zimbra Classic affected versions not specified Description An unauthenticated sender can forge a share notification that triggers stored Cross-Site Scripting XSS, a vulnerability where malicious scripts are permanently stored on the target...
CVE-2026-93641: Improper Neutralization of Input During Web Page Generation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...
CVE-2026-73572
In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...
CVE-2026-73574
Zimbra Collaboration versions before 10.1.17 are affected by a local file inclusion (LFI) vulnerability in the Forward servlet of the Classic Web Client. The root cause is improper validation of the fu request parameter, allowing an unauthenticated attacker to supply a crafted path and disclose p...
CVE-2026-73572
In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...
CVE-2026-73572
In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...
PT-2026-71678
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...
CVE-2026-73572: Improper Neutralization of Input During Web Page Generation
In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...
CVE-2026-73574: Incorrect Resource Transfer Between Spheres
In Zimbra Collaboration before 10.1.17, a local file inclusion LFI vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorize...
VulnCheck KEV: CVE-2025-48700
Synacor Zimbra Collaboration Suite ZCS contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information...
