Synacor vulnerabilities
We track 24 vulnerabilities in Synacor products across 3 products. 17 are rated high or critical, and 18 have been exploited in real attacks. The most recent was published on August 13, 2026.
Latest Synacor vulnerabilities
- 8.9 High severity
Zimbra Collaboration Suite (ZCS) OS Command Injection Exploited
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing
- 8.8 High severity
Zimbra Collaboration Suite: Cross-Site Request Forgery
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Sp
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Exploited
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
- 8.8 High severity
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Exploited
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft req
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unaut
- 8.8 High severity
Zimbra Collaboration Suite: Cross-Site Request Forgery
In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorize
- 5.4 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message c
- 8.8 High severity
Zimbra Collaboration Suite: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by
- 7.5 High severity
Zimbra Collaboration Suite: Inclusion of Functionality from Untrusted Control Sphere
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in t
- 9.8 Critical severity
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Exploited
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploited
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
- 9.0 Critical severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploited
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
- 7.8 High severity
Zimbra Collaboration Suite (ZCS): Privilege Dropping / Lowering Errors
Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.
- 9.8 Critical severity
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts
- 7.8 High severity
Zimbra Server: Improper Access Control
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, whi
- 9.8 Critical severity
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Exploited
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to d
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploited
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
- 7.2 High severity
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Exploited
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory tra
- 7.5 High severity
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Exploited
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
- 6.1 Medium severity
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Exploited
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes.
- 9.8 Critical severity
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Exploited
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
- 9.8 Critical severity
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference Exploited
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
- 7.5 High severity
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Exploited
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploited
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Locatio