CVE-2025-66376

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Oct 7, 2026

Description

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Zimbra	Collaboration	>= 10.0, < 10.0.18; >= 10.1, < 10.1.13

References

https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_FixesRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_FixesRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376US Government Resource

Timeline

Published: Jan 5, 2026
Last modified: Oct 7, 2026
Added to CISA KEV: Mar 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-663777.5Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already h CVE-2025-663787.5Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP CVE-2025-663797.5Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort CVE-2025-66387.5A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting CVE-2025-663825.5In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.CVE-2025-663848.2app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.CVE-2025-663859.4UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a high CVE-2025-663864.1app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.CVE-2025-663886.5A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being proper CVE-2025-663897.5GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fe CVE-2025-66395.4The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versi CVE-2025-663909.8In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant