CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73575

In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...

CVE-2026-73573

CVE-2026-73573 : In Zimbra Collaboration (ZCS) prior to 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit a crafted path traversal sequence, potentially ...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-73570

CVE-2026-73570 is a remote code execution vulnerability in Zimbra Collaboration (ZCS) before 10.1.20 , triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthent...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

PT-2026-71679

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description An issue exists in the Zimbra Briefcase document editing functionality where the packages parameter is not properly validated. An authenticated attacker can use a crafted path...

PT-2026-71678

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...

CVE-2026-33368

Zimbra Collaboration Suite ZCS 10.0 and 10.1 contains a reflected cross-site scripting XSS vulnerability in the Classic Webmail REST interface /h/rest. The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafte...

Zimbra Collaboration - Local File Inclusion

Zimbra Collaboration ZCS 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint. id:...

EUVD-2023-38292

Malicious code in bioql PyPI...

CVE-2023-34193

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function...

CVE-2023-34192

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function...

CVE-2023-45206

Consolidated details for CVE-2023-45206 show a Zimbra Collaboration (ZCS) XSS vulnerability affecting versions 8.8.15, 9.0, and 10.0. The attack vector is via the help document endpoint in webmail, where an attacker can inject JavaScript/HTML, enabling cross-site scripting. The confirmed root cau...

CVE-2023-26562

In Zimbra Collaboration (ZCS) versions 8.8.15–9.0, a closed account (with 2FA and a generated password) can send email when Imap/smtp is configured. Red Hat and other connected sources describe a root cause related to insufficient account-status checks for 2FA accounts, enabling mail sending desp...

CVE-2023-45206

An issue was discovered in Zimbra Collaboration ZCS 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting XSS. Adding an adequate message to avoid malicious code will mitigate this issue...

CVE-2023-43102

CVE-2023-43102 affects Zimbra Collaboration (ZCS) before 10.0.4. An XSS flaw could be exploited to access the mailbox of an authenticated user. This is fixed in ZCS 8.8.15 Patch 43 and 9.0.0 Patch 36 ; remediation is to upgrade to 10.0.4+ or apply the corresponding patches.