CVE-2026-66912

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912 Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912

The Zimbra mail server is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of the From email header value. An attacker can send a crafted email containing a malicious JavaScript payload in the header. When a victim opens this message in the Classic UI and clicks Re...

EUVD-2026-112942

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

Synacor Zimbra Collaboration cross-site scripting vulnerability

Versions of Synacor Zimbra Collaboration prior to 10.1.21 contain a cross-site scripting vulnerability. This flaw stems from improper sanitization of the From email header value, potentially enabling stored cross-site scripting attacks. Attackers can send specially crafted emails containing...

PT-2026-132283

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

Collaboration: XSS

Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...

VulnCheck KEV: CVE-2025-66376

Synacor Zimbra Collaboration Suite ZCS contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets CSS @import directives in email HTML...

Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite

CVE-2025-68645 — Zimbra Classic UI LFI Defender Pack This r...

VulnCheck KEV: CVE-2025-68645

Synacor Zimbra Collaboration Suite ZCS contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory...

CVE-2025-66376

Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...

CVE-2025-66376

Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...

CVE-2025-66376: Improper Neutralization of Input During Web Page Generation

Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...

CVE-2025-66376

CVE-2025-66376 affects Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13. The issue is a stored cross-site scripting (XSS) in the Classic UI caused by CSS @import directives in HTML emails. Impact is described as stored XSS in the Classic UI; no exploit details are provided bey...

PT-2026-1290

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 10.0.18 Zimbra Collaboration Suite versions prior to 10.1.13 Description A stored cross-site scripting XSS flaw exists in the Classic UI of the software. The issue occurs when the HTML sanitizer fai...

📄 Zimbra Collaboration 10.0 / 10.1 Local File Inclusion

This is a proof of concept exploiting a local file inclusion vulnerability existing in the Webmail Classic UI of Zimbra Collaboration ZCS versions 10.0 and 10.1. The issue is due to improper handling of user-supplied request parameters in the RestFilter servlet. zimbramail-CVE-2025-68645-poc A...

Exploit for CVE-2025-68645

zimbramail-CVE-2025-68645-poc A proof-of-concept exp...

CVE-2025-68645

A Local File Inclusion LFI vulnerability exists in the Webmail Classic UI of Zimbra Collaboration ZCS 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influenc...

CVE-2025-68645: Improper Control of Filename for Include/Require Statement in PHP Program

A Local File Inclusion LFI vulnerability exists in the Webmail Classic UI of Zimbra Collaboration ZCS 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influenc...