Vulnerabilities

CVSS

6.1 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Risk score

100.0

Known exploited

CISA KEV

Published

2023-07-31

Status

Analyzed

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

Weaknesses

CWE-79

Coverage 1

vulnerability

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

A critical cross-site scripting (XSS) vulnerability in Zimbra's Classic Web Client could allow attackers to execute malicious code through crafted emails, potentially leading to account compromise and data theft. Zimbra…

The Hacker News · Jul 11, 2026 High

CVE-2025-27915CVE-2023-37580CVE-2024-27443xssvulnerabilityweb client

All articles mentioning it

Advisories and references

• openwall.com/lists/oss-security/2023/11/17/2
• wiki.zimbra.com/wiki/Security_Center
• wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
• openwall.com/lists/oss-security/2023/11/17/2
• wiki.zimbra.com/wiki/Security_Center
• wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-...