CVE-2025-68645

🛡️ CVE-2025-68645 - Zimbra 本地文件包含 LFI 分析 📌 概述 本文档描述了一个影响 Zimbra Collaboration Suite 的本地文件包含 LFI 漏洞。 该问题源于对以下参数的不当处理： root@kitploit: /h/?javax.servlet.include.servletpath= 这允许未经身份验证的用户访问内部应用程序资源。 🔍 漏洞详情 类型： 本地文件包含 LFI 访问权限： 无需身份验证 受影响组件： Webmail（经典界面） 攻击向量： HTTP 请求操纵 🧪 初始验证 测试请求： root@kitploit: cur...

Poc_CVE-2025-68645

CVE-2025-68645 - Zimbra 路径遍历漏洞 📋 概述 CVE-2025-68645 是 Zimbra Collaboration Suite 中的一个路径遍历漏洞，允许未经身份验证的攻击者从服务器文件系统中读取任意文件。 漏洞端点 /h/printconversations?javax.servlet.include.servletpath= 🎯 影响 影响| 严重程度 ---|--- 未授权文件读取| 🔴 高 配置泄露| 🔴 高 凭证泄露| 🔴 高 内网映射| 🟠 中 📁 可读文件 🚀 用法 单目标扫描 python CVE-2025-68645.py.py -t...

Zimbra-CVE-2026-73570-Rules

Wazuh Rules CVE-2026-73570 Zimbra OS Command Injection Detection rules for CVE-2026-73570 , an OS command injection in Zimbra Collaboration Suite via the SNMP trap notification parameter snmpnotify. Vulnerability...

CVE-2026-73570

CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit PoC Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler. Overview...

Zimbra Collaboration Suite - Memcached Command Injection

Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft. id: CVE-2022-27924 info: name:...

CVE-2025-68645

ZimLFI-Hunter CVE-2025-68645 ZimLFI-Hunter 是一款专业的概念验证（PoC）扫描器，用于识别 Zimbra Collaboration Suite 中的 CVE-2025-68645 漏洞。该工具通过 /h/printcalendar 端点检测本地文件包含（LFI）缺陷。 🛡️ 漏洞概述 该漏洞源于某些 Zimbra servlet 中的路径规范化不当，使得未经身份验证的攻击者能够通过操纵 javax.servlet.include.servletpath 参数来包含并读取内部文件（例如 web.xml、localconfig.xml 等）。 🚀...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 本仓库是 hgrab-framework 的一部分 dork title: "Zimbra Web Client Sign In" 受影响的产品 Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23（及更早版本） Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30（及更早版本） 安装 在服务器上安装该应用 root@kitploit: user@domain: git clone...

CVE-2022-27925

CVE-2022-27925 描述 2022 年 5 月 10 日，Zimbra 发布了 9.0.0 Patch 24 和 8.8.15 Patch 31，以解决 Zimbra Collaboration Suite 中的多个漏洞，包括 CVE-2022-27924（我们之前写过）和 CVE-2022-27925。 最初，Zimbra 将 CVE-2022-27925 称为认证路径遍历攻击，即管理员用户可以将文件写入文件系统上 Zimbra 账户下的任意目录。由于该漏洞最初被认为是仅限管理员利用的，NVD 为其分配了 7.8 的 CVSS 基础分数。后来，Volexity...

CVE-2022-37042

CVE-2022-37042 Uso Ver información de vulnerabilidad. root@kitploit: go run main.go -s / / | / / / | \ / \ | \ | / / / // /| \ / / | | / / // // / / // // / / / / / / / // // / / / | |/ / /// // // / // /// / / / // / / / / |// ///// // /// // // @0xf4n9x WRN Use with caution. You are...

CVE-2022-27925

CVE-2022-27925 描述 2022年5月10日，Zimbra发布了9.0.0补丁24和8.8.15补丁31，以修复Zimbra Collaboration Suite中的多个漏洞，包括CVE-2022-27924（我们之前写过）和CVE-2022-27925。...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

Wazuh Rules CVE-2026-73570 Zimbra OS Command Injection Dete...

The vulnerability of the zimbra-snmp package in the Zimbra Collaboration Suite (ZCS) enterprise email management system allows a hacker to execute arbitrary code.

The vulnerability of the zimbra-snmp package in the Zimbra Collaboration Suite email management system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

CVE-2026-73570 PoC - SMTP Command Injection Tester A custom,...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

CVE-2026-73570 CVE-2026-73570 PoC Morehttps://...

Vulnerability handling in Zimbra Collaboration Suite

Zimbra has identified a vulnerability in the Zimbra Collaboration Suite. This vulnerability exists in the Zimbra Collaboration Suite version 10.1.20. Unauthorized attackers can execute OS commands through specially crafted SMTP requests. This requires that the Zimbra SNMP package be installed and...

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Zimbra Collaboration Suite ZCS contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user...

VulnCheck KEV: CVE-2018-14013

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...

The vulnerability of the Zimbra Collaboration Suite’s email management system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the Zimbra Collaboration Suite’s corporate email management system, related to the， allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Zimbra Collaboration Suite email management system is related to the of inter-site requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Synacor Zimbra Collaboration Suite ZCS contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information...