CVE-2025-48700

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wiki.zimbra.com/wiki/Security_CenterRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48700US Government Resource

Timeline

Published: Jun 23, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 20, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-487015.4openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.CVE-2025-487039.0CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in t CVE-2025-487047.5Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort CVE-2025-487057.5An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message for CVE-2025-487069.1An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces t CVE-2025-487077.5An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be s CVE-2025-487083.3gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A create CVE-2025-487097.8BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell acce CVE-2025-48719.8A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of t CVE-2025-487104.1kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to CVE-2025-48729.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component C CVE-2025-487216.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administra