| Package | Affected versions | Patched versions |
|---|---|---|
| collaboration | = 8.8.15 |
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free