VIR Vulnerability Intelligence Relay

CVE-2025-48700

unknown KEV
Published 2026-04-20 · Modified 2026-04-20
CVSS v3
—
CVSS v2
—
VIR risk
1.5

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

CISA KEV

Vendor
Synacor
Product
Zimbra Collaboration Suite (ZCS)
Due date
2026-04-23

Predictions

Exploit likelihood
99%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cisa-kev — https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700

Exploits

References

Verify integrity in audit chain (admin only). AS-IS.