VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Mar 12, 2025· Updated Jun 17, 2026

CVE-2025-27914

CVE-2025-27914

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Zimbra/Collaboration3 versions
    cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*range: >=10.0.0,<10.0.11
    • cpe:2.3:a:zimbra:collaboration:10.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
  • Zimbra/Zimbra Collaboration (ZCS)cpe-rescue2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: 9.0, 10.0, 10.1
  • Zimbra/ZCSllm-fuzzy
    Range: 9.0, 10.0, 10.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.