CVE-2025-25064
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has an official Brazilian government alert.
ssvc Trackcvss 8.8epss 37%
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 03/2025Vulnerabilidade no Zimbra Collaboration Suiteread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a