{"id":"CVE-2025-27915","published":"2025-03-12T15:15:39Z","modified":"2026-06-17T09:04:22Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","provenance":"source","from":"NVD"},"summary":{"text":"Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0 and 10.1 contain a stored cross-site scripting flaw in the Classic Web Client, caused by insufficient sanitization of HTML content in ICS files. An attacker who sends a victim an e-mail with a malicious ICS entry can have its embedded JavaScript run in the victim's session when the message is viewed, which requires the victim to open the message and can enable actions such as setting mail filters to redirect messages or exfiltrating data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:22:14Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.04064,"percentile":0.90667,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2025-10-07","dueDate":"2025-10-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2025-27915","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-09-30","exploitedFirstSeen":"2025-09-30","ransomware":false,"evidence":[{"url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","date":"2025-09-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-07"},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-october-2025-6a3ac29592cb","date":"2025-11-07"},{"url":"https://www.bitsight.com/blog/hidden-dangers-calendar-subscriptions-4-million-devices-risk","date":"2025-11-25"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.proofpoint.com/us/blog/threat-insight/ta458-roundpress-exploits","date":"2026-07-23"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes","tags":["Release Notes"]},{"url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915","tags":["US Government Resource"]}],"techniques":[{"id":"T1566","name":"Phishing","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious email content delivered to victim","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"When a user views an e-mail message containing a malicious ICS entry","start":223,"end":291}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Injected JavaScript executes in victim browser","mappingType":"primary_impact","evidence":[{"from":"description","quote":"its embedded JavaScript executes via an ontoggle event inside a <details> tag","start":293,"end":370}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-7823","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7823","exploited":true,"exploitedSince":"2025-10-07","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-27915","name":"Zimbra - Cross-Site Scripting via ICS Files","severity":"medium","path":"http/cves/2025/CVE-2025-27915.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml"}],"provenance":"source"},"exploitRefs":["https://strikeready.com/blog/0day-ics-attack-in-the-wild/"],"flow":[{"stage":"exploitation","techniques":["T1566"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-03-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27915","provenance":"source"},{"date":"2025-09-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","provenance":"source"},{"date":"2025-10-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7823","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":209},"priority":{"score":61.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 397 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.13,"detail":"percentile 0.9067"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-synacor-zimbra-collaboration-suite-zcs-cwe-79"}}