CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
SysAid On-Prem Unauthenticated XML External Entity (XXE) Vulnerability (CVE-2025-2776) Technical Advisory
[Affected Scope] SysAid On-Prem versions <= 23.3.40
[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application
Adobe Commerce and Magento XML External Entity Reference (XXE) Vulnerability (CVE-2024-34102, CosmicSting) Analysis and Mitigation Guide
[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier
[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)
[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately
Zimbra Collaboration Suite (ZCS) Mailboxd Autodiscover XML External Entity (XXE) Injection Vulnerability (CVE-2019-9670)
[Affected Scope] Synacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10
[Impact] Unauthenticated remote attackers can exploit this XML External Entity (XXE) vulnerability to read arbitrary local files, perform SSRF, and achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint