Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-2776

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

CVSS 9.3 · CriticalBuzz score 68.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 68.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
23.0
9 evidence mentions in the snapshot
Diversity score
20.0
7 sources across 5 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
9 source links · newest first
  • Ticket to Shell: Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200)Horizon3.ai

    CVE-2026-22200 is a severe vulnerability affecting osTicket, a popular open source helpdesk and ticketing system. This vulnerability enables anonymous attackers to read arbitrary files from the osTicket server, and in some cases execute arbitrary code. This issue is patched in osTicket 1.18.3 / 1.17.7.

    exploithorizon3.aiJan 22, 2026, 3:51 PM
  • CVE-2026-22200Horizon3.ai

    osTicket PHP Filter Chain Injection Vulnerability

    exploithorizon3.aiJan 12, 2026, 9:32 PM
  • U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: This week CrushFTP warned of a zero-day, tracked as CVE-2025-54309 (CVSS score of 9.0), […]

    newssecurityaffairs.comJul 24, 2025, 6:48 AM
  • CISA Warns of SysAid Vulnerability ExploitationSecurityWeek

    CISA has added two recent SysAid vulnerabilities, CVE-2025-2776 and CVE-2025-2775, to its KEV catalog.

    newswww.securityweek.comJul 23, 2025, 7:47 AM
  • Dozens of SysAid Instances Vulnerable to Remote HackingSecurityWeek

    SysAid patches IT service management software vulnerabilities that can be chained for unauthenticated remote command execution.

    newswww.securityweek.comMay 8, 2025, 9:24 AM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govMay 7, 2025, 3:15 PM
  • https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/labs.watchtowr.com

    No excerpt available.

    Exploitlabs.watchtowr.comMay 7, 2025, 3:15 PM
  • https://documentation.sysaid.com/docs/24-40-60documentation.sysaid.com

    No excerpt available.

    Vendor Advisorydocumentation.sysaid.comMay 7, 2025, 3:15 PM
  • PoC exploit for SysAid pre-auth RCE released, upgrade quickly!Help Net Security

    WatchTowr researchers have released a proof-of-concept (PoC) exploit that chains two vulnerabilities in SysAid On-Prem – the self-hosted version of the platform behind SysAid’s popular IT service management and IT helpdesk solutions – to achieve unauthenticated remote code execution on the underlying server. The vulnerabilities have been patched in SysAid On-Prem v24.4.60, released in early March 2025, but it’s likely that many enterprises have not upgraded yet. Creating the PoC “In an on-premise deployment, SysAid … More →

    newswww.helpnetsecurity.comMay 7, 2025, 12:20 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2025-2777

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator a…

    CVSS 9.3 · Critical
    4 mentions
  • CVE-2025-2775

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrato…

    CVSS 9.3 · Critical
    KEV listed9 mentions
  • CVE-2026-73235

    FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader()…

    CVSS 6.1 · Medium
    6 mentions
  • CVE-2026-58248

    SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external…

    CVSS 6.5 · Medium
    2 mentions
  • CVE-2026-16626

    Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 befo…

    CVSS 9.3 · Critical
    1 mention
  • CVE-2026-65432

    Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from th…

    CVSS 7.5 · High
    2 mentions