[ Vendor · 19 CVEs ]
Synacor
CVEs affecting Synacor published in the last 30 days, plus any Synacor CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-73570 | 13 Aug 2026 | CVSS 8.9 | Zimbra Collaboration Suite (ZCS) OS Command InjectionA remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP… | Exploited |
| CVE-2025-66376 | 5 Jan 2026 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site ScriptingZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives… | Exploited |
| CVE-2025-68645 | 22 Dec 2025 | CVSS 8.8 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File InclusionA Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling… | Exploited |
| CVE-2025-48700 | 23 Jun 2025 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site ScriptingAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra… | Exploited |
| CVE-2025-27915 | 12 Mar 2025 | CVSS 5.4 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site ScriptingAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic… | Exploited |
| CVE-2024-45519 | 2 Oct 2024 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Command ExecutionThe postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1… | Exploited |
| CVE-2024-27443 | 12 Aug 2024 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature… | Exploited |
| CVE-2023-37580 | 31 Jul 2023 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. | ExploitedFix |
| CVE-2023-34192 | 6 Jul 2023 | CVSS 9.0 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to… | Exploited |
| CVE-2022-41352 | 26 Sep 2022 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole… | ExploitedFix |
| CVE-2022-37042 | 12 Aug 2022 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Authentication BypassZimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing… | ExploitedFix |
| CVE-2022-27924 | 21 Apr 2022 | CVSS 7.5 | Synacor Zimbra Collaboration Suite (ZCS) Command InjectionZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance… | Exploited |
| CVE-2022-27925 | 21 Apr 2022 | CVSS 7.2 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File UploadZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated… | Exploited |
| CVE-2022-27926 | 21 Apr 2022 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows… | Exploited |
| CVE-2022-24682 | 9 Feb 2022 | CVSS 6.1 | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site ScriptingAn issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild… | Exploited |
| CVE-2020-7796 | 18 Feb 2020 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request ForgeryZimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. | Exploited |
| CVE-2019-9670 | 29 May 2019 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Referencemailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as… | ExploitedFix |
| CVE-2019-9621 | 30 Apr 2019 | CVSS 7.5 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF)Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows… | Exploited |
| CVE-2018-6882 | 27 Mar 2018 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1… | Exploited |