synacor
5 records · 5 with a public proof-of-concept
Disclosed vulnerabilities where the NVD names synacor as an affected vendor, highest CVSS first.
- HIGH 7.1CVE-2026-93631public PoC
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or …
zimbra collaboration suite
- MEDIUM 6.1CVE-2026-93638public PoC
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inser…
zimbra collaboration suite
- MEDIUM 5.4CVE-2026-93633public PoC
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII c…
zimbra collaboration suite
- MEDIUM 4.3CVE-2026-93636public PoC
An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied…
zimbra collaboration suite
- MEDIUM 4.3CVE-2026-93634public PoC
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization …
zimbra collaboration suite