CVE-2025-27915

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27915

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

A

n issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

References
Link Resource
https://wiki.zimbra.com/wiki/Security_Center Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes Release Notes
https://strikeready.com/blog/0day-ics-attack-in-the-wild/ Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p43:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*
History

04 Nov 2025, 16:45

Type Values Removed Values Added
CPE cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p28:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p29:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p43:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p40:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p41:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p42:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*		 cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p43:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:*
First Time Synacor
Synacor zimbra Collaboration Suite
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 - US Government Resource

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 -

08 Oct 2025, 12:48

Type Values Removed Values Added
References () https://strikeready.com/blog/0day-ics-attack-in-the-wild/ - () https://strikeready.com/blog/0day-ics-attack-in-the-wild/ - Exploit, Third Party Advisory

07 Oct 2025, 18:15

Type Values Removed Values Added
References
  • () https://strikeready.com/blog/0day-ics-attack-in-the-wild/ -

02 Apr 2025, 20:38

Type Values Removed Values Added
First Time Zimbra collaboration
Zimbra
References () https://wiki.zimbra.com/wiki/Security_Center - () https://wiki.zimbra.com/wiki/Security_Center - Release Notes
References () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes - () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes - Release Notes
References () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes - () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes - Release Notes
References () https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes - () https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes - Release Notes
CPE cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p42:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p40:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p28:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p41:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p29:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p43:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*
cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*

12 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-12 15:15

Updated : 2025-11-04 16:45

NVD link : CVE-2025-27915

Mitre link : CVE-2025-27915

CVE.ORG link : CVE-2025-27915

JSON object : View

Products Affected

synacor

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')