SysAid vulnerabilities
We track 8 vulnerabilities in SysAid products across 5 products. 8 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on May 7, 2025.
Latest SysAid vulnerabilities
- 9.8 Critical severity
SysAid On-Prem: Improper Restriction of XML External Entity Reference
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
- 9.8 Critical severity
SysAid On-Prem Improper Restriction of XML External Entity Reference Exploited
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
- 7.5 High severity
SysAid On-Prem Improper Restriction of XML External Entity Reference Exploited
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
- 9.8 Critical severity
SysAid Server Path Traversal Exploited
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
- 7.2 High severity
Sysaid: Unrestricted Upload of File with Dangerous Type
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.
- 9.8 Critical severity
SysAid - Okta SSO integration: Improper Restriction of XML External Entity Reference
SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration might be vulnerable. An unauthenticated attacker could exploit the XXE vulnerability by sending a mal
- 9.8 Critical severity
Sysaid: Improper Limitation of a Pathname to a Restricted Directory
Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution
- 9.8 Critical severity
Sysaid: Improper Authentication
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.