CVE-2022-27926

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 21, 2022
Last modified
Jun 17, 2026
Added to CISA KEV
Apr 3, 2023
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-279279.8A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attackerCVE-2022-279287.5Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-279297.5Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-27937.8Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no aCVE-2022-279305.9Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique IdentiCVE-2022-279317.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-279327.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-279338.2Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-279347.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-279357.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.CVE-2022-279367.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.CVE-2022-279377.5Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.