CVE-2023-37580: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Published Jul 31, 2023 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Synacor vulnerabilities
All Synacor entriesCVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
high8.9ExploitedAug 13, 2026CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
medium6.1ExploitedJan 5, 2026CVE-2025-68645
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
high8.8ExploitedDec 22, 2025CVE-2025-48700
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
medium6.1ExploitedJun 23, 2025CVE-2025-27915
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
medium5.4ExploitedMar 12, 2025CVE-2024-45519
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
critical9.8ExploitedOct 2, 2024