Exploited Vulnerabilities Daily
🌐 English

Home › Synacor

CVE-2025-27915: Synacor Zimbra Collaboration Suite (ZCS)

EPSS4.0%No. 1458 of 1739 in KEV
CVE year2025listed the same year
Same vendor in KEV19
Same product17
FieldValue
VendorSynacor
ProductZimbra Collaboration Suite (ZCS)
NameSynacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Added to KEV2025-10-07
US federal due date2025-10-28
Ransomware useUnknown
CWECWE-79

CISA description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Other entries for this product

CVEVendor / productAddedEPSSRansomware
CVE-2026-73570Synacor Zimbra Collaboration Suite (ZCS)2026-08-2171.6%Unknown
CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS)2026-04-201.7%Unknown
CVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS)2026-03-1820.2%Unknown
CVE-2025-68645Synacor Zimbra Collaboration Suite (ZCS)2026-01-2248.8%Unknown
CVE-2019-9621Synacor Zimbra Collaboration Suite (ZCS)2025-07-0781.0%Unknown
CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS)2025-05-1923.6%Unknown
CVE-2023-34192Synacor Zimbra Collaboration Suite (ZCS)2025-02-2577.2%Unknown
CVE-2024-45519Synacor Zimbra Collaboration Suite (ZCS)2024-10-0399.9%Unknown
CVE-2023-37580Synacor Zimbra Collaboration Suite (ZCS)2023-07-2749.0%Unknown
CVE-2022-27926Synacor Zimbra Collaboration Suite (ZCS)2023-04-0317.6%Unknown
CVE-2022-41352Synacor Zimbra Collaboration Suite (ZCS)2022-10-2095.4%Known
CVE-2022-37042Synacor Zimbra Collaboration Suite (ZCS)2022-08-1191.8%Known
CVE-2022-27925Synacor Zimbra Collaboration Suite (ZCS)2022-08-1198.6%Known
CVE-2022-27924Synacor Zimbra Collaboration Suite (ZCS)2022-08-0493.9%Known
CVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS)2022-04-1929.7%Known

NVD — CVE-2025-27915

Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page

A Synacor Zimbra Collaboration Suite (ZCS) vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-07.