CVE-2026-33373 | High | 8.8 | 2026-03-30 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the i… |
CVE-2026-33372 | Medium | 5.4 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper… |
CVE-2026-33371 | Medium | 4.3 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS… |
CVE-2026-33370 | Medium | 6.1 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature d… |
CVE-2026-33369 | Medium | 4.3 | 2026-03-20 | Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation. The application… |
CVE-2026-33368 | Medium | 6.1 | 2026-03-20 | Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). T… |
CVE-2025-66376 | High | 7.2 | 2026-01-05 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM… |
CVE-2025-68645 | High | 8.8 | 2025-12-22 | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-su… |
CVE-2025-48700 | Medium | 6.1 | 2025-06-23 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI all… |
CVE-2024-45516 | Medium | 6.1 | 2025-05-14 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-S… |
CVE-2025-32354 | High | 8.8 | 2025-04-29 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) o… |
CVE-2025-27915 | Medium | 5.4 | 2025-03-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client… |
CVE-2025-25065 | Medium | 5.3 | 2025-02-03 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized re… |
CVE-2025-25064 | High | 8.8 | 2025-02-03 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient… |
CVE-2024-54663 | High | 7.5 | 2024-12-19 | An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the… |
CVE-2024-45517 | Medium | 5.4 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail an… |
CVE-2024-45513 | Medium | 4.8 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endp… |
CVE-2024-45194 | Medium | 4.8 | 2024-11-21 | In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacke… |
CVE-2024-45514 | Medium | 5.4 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmai… |
CVE-2024-45512 | Medium | 5.4 | 2024-11-21 | An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase… |
CVE-2024-45510 | Medium | 5.4 | 2024-11-20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due… |
CVE-2024-45511 | Medium | 5.4 | 2024-11-20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to imp… |
CVE-2024-50599 | Medium | 6.1 | 2024-11-07 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endp… |
CVE-2024-45519 | Critical | 10.0 | 2024-10-02 | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allow… |
CVE-2023-37580 | Medium | 6.1 | 2023-07-31 | Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. |
CVE-2023-34192 | Critical | 9.0 | 2023-07-06 | Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoS… |
CVE-2022-3569 | High | 7.8 | 2022-10-17 | Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior… |
CVE-2022-41352 | Critical | 9.8 | 2022-09-26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to… |
CVE-2022-37393 | High | 7.8 | 2022-08-16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zms… |
CVE-2022-37042 | Critical | 9.8 | 2022-08-12 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authenticatio… |
CVE-2022-27926 | Medium | 6.1 | 2022-04-21 | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated… |
CVE-2022-27925 | High | 7.2 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with a… |
CVE-2022-27924 | High | 7.5 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache… |
CVE-2022-24682 | Medium | 6.1 | 2022-02-09 | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in Dec… |
CVE-2020-18985 | Medium | 6.1 | 2021-12-15 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. |
CVE-2020-18984 | Medium | 6.1 | 2021-12-15 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticate… |
CVE-2020-13653 | Medium | 6.1 | 2020-07-02 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScrip… |
CVE-2020-12846 | High | 8.0 | 2020-06-03 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet… |
CVE-2020-8633 | Medium | 5.3 | 2020-02-18 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed moun… |
CVE-2020-7796 | Critical | 9.8 | 2020-02-18 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. |
CVE-2019-11318 | Medium | 5.4 | 2020-01-27 | Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. |
CVE-2015-2249 | Medium | 5.4 | 2020-01-27 | Zimbra Collaboration before 8.6.0 patch5 has XSS. |
CVE-2014-8563 | Critical | 9.8 | 2020-01-27 | Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. |
CVE-2014-5500 | Medium | 6.1 | 2020-01-27 | Synacor Zimbra Collaboration before 8.0.8 has XSS. |
CVE-2015-7609 | Medium | 6.1 | 2019-05-30 | Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra. |
CVE-2015-2230 | Medium | 6.1 | 2019-05-30 | Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. |
CVE-2018-14425 | Medium | 6.1 | 2019-05-30 | There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch… |
CVE-2018-10948 | Medium | 4.8 | 2019-05-30 | Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs. |
CVE-2018-15131 | Medium | 5.3 | 2019-05-30 | An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 b… |
CVE-2019-9670 | Critical | 9.8 | 2019-05-29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au… |
CVE-2019-6981 | Medium | 6.5 | 2019-05-29 | Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component. |
CVE-2019-6980 | Critical | 9.8 | 2019-05-29 | Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component. |
CVE-2018-20160 | Critical | 9.8 | 2019-05-29 | ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks… |
CVE-2018-18631 | Medium | 6.1 | 2019-05-29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS. |
CVE-2018-14013 | Medium | 6.1 | 2019-05-29 | Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. |
CVE-2019-9621 | High | 7.5 | 2019-04-30 | Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via th… |
CVE-2018-17938 | Medium | 5.3 | 2018-10-03 | Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value. |
CVE-2018-10939 | Medium | 6.1 | 2018-05-30 | Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group. |
CVE-2015-7610 | High | 8.8 | 2018-05-30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, a… |
CVE-2018-10951 | Medium | 6.5 | 2018-05-10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a Ge… |
CVE-2018-10950 | Medium | 5.3 | 2018-05-10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Err… |
CVE-2018-10949 | Medium | 5.3 | 2018-05-10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "… |
CVE-2018-6882 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x b… |
CVE-2017-8783 | Medium | 5.4 | 2018-02-04 | Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS. |
CVE-2017-17703 | Medium | 6.1 | 2018-02-04 | Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS. |
CVE-2017-7288 | Medium | 6.1 | 2017-05-23 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via un… |
CVE-2017-6821 | Critical | 9.8 | 2017-05-23 | Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors. |
CVE-2017-6813 | Critical | 9.8 | 2017-05-23 | A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations. |
CVE-2016-3403 | High | 8.8 | 2017-05-17 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack t… |
CVE-2016-9924 | Critical | 9.8 | 2017-03-29 | Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. |
CVE-2016-4019 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 104477. |
CVE-2016-3999 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3415 | Critical | 9.1 | 2017-01-18 | Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276. |
CVE-2016-3414 | Medium | 6.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 10… |
CVE-2016-3413 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103996. |
CVE-2016-3412 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3411 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2016-3410 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3409 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2016-3408 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2016-3407 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3406 | High | 8.8 | 2017-01-18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecif… |
CVE-2016-3405 | High | 7.5 | 2017-01-18 | Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, aka bugs 103961 and 1… |
CVE-2016-3404 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103959. |
CVE-2016-3402 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bug 99167. |
CVE-2016-3401 | Medium | 6.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810. |
CVE-2013-7091 | | | 2013-12-13 | Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attac… |
CVE-2013-5119 | | | 2013-09-23 | Zimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZM_AUTH_TOKEN… |