Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/02/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| zimbra collaboration suite | = 8.8.15 |
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free