Vulnerabilidades en Zammad
46 resultadosCVE-2025-32358MEDIUMIn Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests EPSS 0.3%CVE-2026-84462HIGHZammad: AI Agent template sanitizer bypass leads to remote code executionEPSS 0.3%CVE-2026-56723HIGHZammad: Missing authorization on ticket attachment downloadEPSS 0.3%CVE-2026-56724HIGHZammad: Incorrect implementation of permission checks in the knowledge base moduleEPSS 0.3%CVE-2025-32357MEDIUMIn Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base EPSS 0.3%CVE-2026-56733HIGHZammad: Incorrect Authorization and Improper Privilege ManagementEPSS 0.3%CVE-2026-84460MEDIUMZammad: Missing Authorization in TagsController#list Allows Cross-Object Tag EnumerationEPSS 0.3%CVE-2025-32360MEDIUMIn Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, aEPSS 0.3%CVE-2026-34719HIGHZammad has a Server-side request forgery (SSRF) via webhooksEPSS 0.3%CVE-2026-56727HIGHZammad: PGP signature spoofing via unvalidated verification returnEPSS 0.2%CVE-2026-63216MEDIUMZammad: Stored XSS via unescaped option labels in the object attribute options context UIEPSS 0.2%CVE-2026-56731HIGHZammad: Cross-Site Scripting in Ticket NotificationsEPSS 0.2%CVE-2026-102345MEDIUMZammad: Stored XSS in ticket article rendering in the new Vue-based interfaceEPSS 0.2%CVE-2026-61855MEDIUMZammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound MailEPSS 0.2%CVE-2026-65828LOWZammad: Pending upload deletion bypass via legacy attachment endpointEPSS 0.2%CVE-2026-34248LOWZammad has an information disclosure in ticket detail view of customers in shared organizationsEPSS 0.2%CVE-2026-56732MEDIUMZammad: Malicious input in Ticket Body Enables Session TerminationEPSS 0.2%CVE-2026-34837MEDIUMZammad is miissing authorization in AI assistance controller for context data used in text toolsEPSS 0.2%CVE-2026-34722MEDIUMZammad is missing authorization in ticket create endpointEPSS 0.2%CVE-2026-34782MEDIUMZammad has improper access control in AI assistance controller for text toolsEPSS 0.2%