Unrated severityNVD Advisory· Published Feb 3, 2025· Updated Feb 26, 2026

CVE-2025-25064

Description

SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zimbra/Collaboration Servercpe-rescue
Zimbra/Zimbra Collaboration (ZCS)llm-fuzzy
Range: <10.0.12, <10.1.4

Patches

Vulnerability mechanics

References

wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12mitre
wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4mitre
wiki.zimbra.com/wiki/Zimbra_Security_Advisoriesmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.027
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000