CVE-2026-93642

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

EUVD-2026-87099

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

EUVD-2026-87098

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

PT-2026-98864

Name of the Vulnerable Software and Affected Versions Zimbra affected versions not specified Description An unauthenticated sender can forge a share notification that triggers stored Cross-Site Scripting XSS, a vulnerability where malicious scripts are permanently stored on the target server. Thi...

PT-2026-98863

Name of the Vulnerable Software and Affected Versions Zimbra Classic affected versions not specified Description An unauthenticated sender can forge a share notification that triggers stored Cross-Site Scripting XSS, a vulnerability where malicious scripts are permanently stored on the target...

CVE-2024-45512: Improper Neutralization of Input During Web Page Generation

An issue was discovered in webmail in Zimbra Collaboration ZCS through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a victim. When the victim interacts with the folder share notification, the malicious...