high8.8
CVE-2025-25064
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient …
Impact
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Synacor | Zimbra Collaboration Suite | from 10.0.0 before 10.0.12 from 10.1.0 before 10.1.4 |