Firetruck

CVE-2025-48700

KEV

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

View CVE record →
Vendor / Project
Synacor
Product
Zimbra Collaboration Suite (ZCS)
Date added
Apr 20, 2026
Due date
Apr 23, 2026
Known ransomware use
Unknown
CWEs
CWE-79

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes