Trending
CVE-2025-48700

CVE detail

CVE-2025-48700

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

CVSS 6.1 · MediumBuzz score 66.5KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 66.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 19.5 · KEV 25.0 · OTX 0.0 · PoC 0.0

Mention score

22.0

8 evidence mentions in the snapshot

Diversity score

19.5

6 sources across 3 categories

KEV score

25.0

Known exploited vulnerability present

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 0; within the 30d window
Peak daily: 0; highest bucket

Evidence

Source links by recency

Newest mentions first

8 source links · newest first

Zimbra urges customers to patch critical web client XSS flawBleepingComputer
the Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch another Zimbra XSS flaw (CVE-2025-66376) exploited by hackers linked to the APT28 group (linked to Russia's military intelligence service) in attacks targeting Ukrainian government entities . In April, nonprofit security organization Shadowserver warned that
newswww.bleepingcomputer.comJul 10, 2026, 11:47 AM
CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133)Help Net Security
CISA added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a Cisco Catalyst SD-WAN Manager vulnerability (CVE-2026-20133) that Cisco has yet to flag as exploited. Three Cisco Catalyst SD-WAN Manager vulnerabilities Alongside CVE-2026-20133, CISA has also listed CVE-2026-20128 and CVE-2026-20122 – two other Catalyst SD-WAN Manager vulnerabilities – as being leveraged in attacks. The latter two flaws have been confirmed as actively exploited by Cisco in early March 2026. In March, VulnCheck’s … More →
newswww.helpnetsecurity.comApr 21, 2026, 11:26 AM
Organizations Warned of Exploited Cisco, Kentico, Zimbra VulnerabilitiesSecurityWeek
CISA expanded the KEV catalog with eight flaws, but five of them have been flagged as exploited before.
newswww.securityweek.comApr 21, 2026, 11:19 AM
U.S. CISA adds Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known […]
newssecurityaffairs.comApr 21, 2026, 9:21 AM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48700www.cisa.gov
No excerpt available.
Mitigationwww.cisa.govJun 23, 2025, 3:15 PM
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisorieswiki.zimbra.com
No excerpt available.
Vendor Advisorywiki.zimbra.comJun 23, 2025, 3:15 PM
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policywiki.zimbra.com
No excerpt available.
Vendor Advisorywiki.zimbra.comJun 23, 2025, 3:15 PM
https://wiki.zimbra.com/wiki/Security_Centerwiki.zimbra.com
No excerpt available.
Vendor Advisorywiki.zimbra.comJun 23, 2025, 3:15 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-33370
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient s…
CVSS 6.1 · Medium
4 mentions
CVE-2026-33368
Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails…
CVSS 6.1 · Medium
4 mentions
CVE-2025-66376
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVSS 7.2 · High
KEV listed20 mentions
CVE-2024-45516
An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS)…
CVSS 6.1 · Medium
CVE-2025-27915
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient…
CVSS 5.4 · Medium
KEV listed12 mentions
CVE-2024-45517
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interf…
CVSS 5.4 · Medium

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2025-48700.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:synacor:zimbra_collaboration_suiteSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2025-48700Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Analyzed

Published

Jun 23, 2025

Modified

Jun 17, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): Required. Another user must take an action for exploitation to succeed.
Scope (S): Changed. Impacts can cross into a different security authority.
Confidentiality Impact (C): Low. There is a limited impact to this security property.
Integrity Impact (I): Low. There is a limited impact to this security property.
Availability Impact (A): None. There is no direct impact to this security property.

Signals

Exploitation indicators

1 stored signals · KEV present · 0 OTX pulses

KEVKEV
- cwes: CWE-79
- dueDate: 2026-04-23
- knownRansomwareCampaignUse: Unknown
- notes: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700
- product: Zimbra Collaboration Suite (ZCS)
- requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- shortDescription: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.
- vendorProject: Synacor
- vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Observed Apr 20, 2026, 12:00 AM