{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1566.002 Spearphishing Link","home_page_url":"https://patchfirst.co/technique/T1566.002/","feed_url":"https://patchfirst.co/feed/technique/T1566.002.json","description":"New and newly exploited CVEs that lead to ATT&CK T1566.002 Spearphishing Link, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-48700#kev","url":"https://patchfirst.co/cve/CVE-2025-48700/","title":"[KEV] CVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1059.007 JavaScript. Priority 62.7 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T09:30:11.000Z","tags":["kev","T1566.002","T1056","T1059.007"],"_patchfirst":{"reason":"kev","priority":62.7,"kev":{"dateAdded":"2026-04-20","ransomware":false},"epss":{"score":0.01713,"percentile":0.77356},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1056","T1059.007"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-2533#kev","url":"https://patchfirst.co/cve/CVE-2023-2533/","title":"[KEV] CVE-2023-2533: PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2025-07-28. ENISA EUVD lists it as exploited. EPSS 28.8% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter; T1547 Boot or Logon Autostart Execution. Priority 68.8 of 100.","summary":"PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability","date_published":"2025-07-28T00:00:00.000Z","date_modified":"2026-06-17T05:52:47.000Z","tags":["kev","public-exploit","T1566.002","T1059","T1547"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2025-07-28","ransomware":false},"epss":{"score":0.28831,"percentile":0.98146},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1566.002","T1059","T1547"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-42009#kev","url":"https://patchfirst.co/cve/CVE-2024-42009/","title":"[KEV] CVE-2024-42009: RoundCube Webmail Cross-Site Scripting Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.","summary":"RoundCube Webmail Cross-Site Scripting Vulnerability","date_published":"2025-06-09T00:00:00.000Z","date_modified":"2026-06-17T07:48:37.000Z","tags":["kev","public-exploit","T1566.002","T1056","T1114"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-06-09","ransomware":false},"epss":{"score":0.82882,"percentile":0.99671},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1566.002","T1056","T1114"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-27443#kev","url":"https://patchfirst.co/cve/CVE-2024-27443/","title":"[KEV] CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T07:19:54.000Z","tags":["kev","public-exploit","T1566.002","T1059.004","T1114","T1041"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.24606,"percentile":0.97881},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1059.004","T1114","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21413#kev","url":"https://patchfirst.co/cve/CVE-2024-21413/","title":"[KEV] CVE-2024-21413: Microsoft Outlook Improper Input Validation Vulnerability","content_text":"Microsoft · Office Outlook. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Microsoft Outlook Improper Input Validation Vulnerability","date_published":"2025-02-06T00:00:00.000Z","date_modified":"2026-08-10T16:18:51.000Z","tags":["kev","public-exploit","T1566.002","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-02-06","ransomware":false},"epss":{"score":0.9466,"percentile":0.99856},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Office Outlook","techniqueIds":["T1566.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-6882#kev","url":"https://patchfirst.co/cve/CVE-2018-6882/","title":"[KEV] CVE-2018-6882: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-04-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 29.8% (higher than 98.2% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter. Priority 76.9 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","date_published":"2022-04-19T00:00:00.000Z","date_modified":"2026-10-01T20:17:17.000Z","tags":["kev","ransomware","public-exploit","T1566.002","T1059"],"_patchfirst":{"reason":"kev","priority":76.9,"kev":{"dateAdded":"2022-04-19","ransomware":true},"epss":{"score":0.29761,"percentile":0.98196},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5119#kev","url":"https://patchfirst.co/cve/CVE-2015-5119/","title":"[KEV] CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability","content_text":"Adobe · Flash Player. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 98.6% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059.007 JavaScript; T1566.002 Spearphishing Link; T1105 Ingress Tool Transfer; T1055.001 Dynamic-link Library Injection; T1071.001 Web Protocols. Named in 5 threat reports. Priority 74.8 of 100.","summary":"Adobe Flash Player Use-After-Free Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T00:28:28.000Z","tags":["kev","public-exploit","T1059.007","T1566.002","T1105","T1055.001","T1071.001"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.98618,"percentile":0.99923},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Flash Player","techniqueIds":["T1059.007","T1566.002","T1105","T1055.001","T1071.001"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-15233","url":"https://patchfirst.co/cve/CVE-2020-15233/","title":"CVE-2020-15233: OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses","content_text":"ory · fosite. Not in CISA KEV. EPSS 0.8% (higher than 56.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 15.6 of 100.","summary":"OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses","date_published":"2020-10-02T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":15.6,"kev":null,"epss":{"score":0.008,"percentile":0.56531},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"ory","product":"fosite","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5270","url":"https://patchfirst.co/cve/CVE-2020-5270/","title":"CVE-2020-5270: Open redirection when using back parameter of PrestaShop","content_text":"PrestaShop · PrestaShop. Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 4.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1005 Data from Local System; T1036 Masquerading; T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 14.4 of 100.","summary":"Open redirection when using back parameter of PrestaShop","date_published":"2020-04-20T00:00:00.000Z","date_modified":"2024-08-04T08:22:09.000Z","tags":["T1566.002","T1005","T1036","T1059.007","T1557"],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00832,"percentile":0.57598},"cvss":{"score":4.1,"severity":"MEDIUM","version":"3.1"},"vendor":"PrestaShop","product":"PrestaShop","techniqueIds":["T1566.002","T1005","T1036","T1059.007","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3788","url":"https://patchfirst.co/cve/CVE-2019-3788/","title":"CVE-2019-3788: UAA redirect-uri allows wildcard in the subdomain","content_text":"Cloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 0.8% (higher than 57.6% of CVEs). CVSS 8.7 HIGH. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 17.6 of 100.","summary":"UAA redirect-uri allows wildcard in the subdomain","date_published":"2019-04-25T00:00:00.000Z","date_modified":"2024-09-16T22:02:12.000Z","tags":["T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":17.6,"kev":null,"epss":{"score":0.00832,"percentile":0.57572},"cvss":{"score":8.7,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"UAA Release (OSS)","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3778","url":"https://patchfirst.co/cve/CVE-2019-3778/","title":"CVE-2019-3778: Open Redirect in spring-security-oauth2","content_text":"Spring · Spring Security OAuth. Not in CISA KEV. EPSS 16.6% (higher than 97% of CVEs). Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 25.5 of 100.","summary":"Open Redirect in spring-security-oauth2","date_published":"2019-03-07T00:00:00.000Z","date_modified":"2024-09-16T20:57:23.000Z","tags":["public-exploit","T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":25.5,"kev":null,"epss":{"score":0.16596,"percentile":0.97009},"cvss":null,"vendor":"Spring","product":"Spring Security OAuth","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-11067","url":"https://patchfirst.co/cve/CVE-2018-11067/","title":"CVE-2018-11067: Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability","content_text":"Dell EMC · Avamar. Not in CISA KEV. EPSS 1.8% (higher than 78.6% of CVEs). ATT&CK: T1566.002 Spearphishing Link; T1036 Masquerading. Priority 15.7 of 100.","summary":"Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability","date_published":"2018-11-26T00:00:00.000Z","date_modified":"2024-09-17T00:11:44.000Z","tags":["T1566.002","T1036"],"_patchfirst":{"reason":"published","priority":15.7,"kev":null,"epss":{"score":0.01811,"percentile":0.78597},"cvss":null,"vendor":"Dell EMC","product":"Avamar","techniqueIds":["T1566.002","T1036"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}