SysAid On-Prem vulnerabilities

3 known vulnerabilities in SysAid On-Prem from SysAid. 3 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  SysAid On-Prem: Improper Restriction of XML External Entity Reference

  CVE-2025-2777May 7, 2025SysAidEPSS 72.9%

  SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

• 9.8 Critical severity

  SysAid On-Prem Improper Restriction of XML External Entity Reference Exploited

  CVE-2025-2776May 7, 2025SysAidEPSS 65.2%

  SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

• 7.5 High severity

  SysAid On-Prem Improper Restriction of XML External Entity Reference Exploited

  CVE-2025-2775May 7, 2025SysAidEPSS 43.2%

  SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.