Live › vulnerability › CVE-2018-6882
Go to dashboardZimbra Collaboration Suite has a cross-site scripting flaw that lets a remote attacker inject arbitrary web script or HTML. CISA lists it as actively exploited, and the tags mark it as used in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Synacor Zimbra Collaboration Suite (ZCS) | vendor | – | – |
Unknown from the sources.
Apply the Zimbra updates per vendor instructions; the sources do not give a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
This page as .md · .json · in your agent: get_signal("CVE-2018-6882")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.