Znuny

Records16All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Znuny records in CISA KEV

No Znuny vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Znuny 11 records MEDIUM

Records

16 records

TI-2025-19719 CVE-2025-26846 · GHSA-m53m-r8mm-799v

An issue was discovered in Znuny before 7.1.4.

MEDIUM 49

An issue was discovered in Znuny before 7.1.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00431 Published 2025-05-12 No fix listed CWE-862

TI-2025-19718 CVE-2025-26845 · GHSA-8hx2-3q2m-9xxf

An Eval Injection issue was discovered in Znuny through 7.1.3.

MEDIUM 49

An Eval Injection issue was discovered in Znuny through 7.1.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00504 Published 2025-05-08 No fix listed CWE-95

TI-2025-19717 CVE-2025-26844 · GHSA-qjp8-wwq5-32hp

An issue was discovered in Znuny through 7.1.3.

MEDIUM 49

An issue was discovered in Znuny through 7.1.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00431 Published 2025-05-08 No fix listed CWE-1004

TI-2025-19720 CVE-2025-26847 · GHSA-crjm-f8jp-7pww

An issue was discovered in Znuny before 7.1.5.

MEDIUM 45

An issue was discovered in Znuny before 7.1.5.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00402 Published 2025-05-08 No fix listed CWE-521

TI-2024-21383 CVE-2024-32491 · GHSA-fg45-47x2-7rw4

An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1…

MEDIUM 44

An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file (via a manipulated AJAX Request) to an arbitrary writable location by traversing…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00719 Published 2024-04-29 No fix listed CWE-94

TI-2026-74584 CVE-2026-93483 · GHSA-g4fx-r8m5-c6r7

Authentication bypass in Znuny via forged Remote-User header

MEDIUM 42

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00234 Published 2026-10-15 Fixed in 6.5.25, 7.3.7 CWE-348

TI-2026-74585 CVE-2026-93484 · GHSA-mxcg-m44c-38cw

SQL injection in Znuny ticket search via ContentSearch parameter

LOW 39

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.003 Published 2026-10-15 Fixed in 6.5.25, 7.3.7 CWE-89

TI-2025-19716 CVE-2025-26842 · GHSA-c2x5-mpj8-v9v9

An issue was discovered in Znuny through 7.1.3.

LOW 39

An issue was discovered in Znuny through 7.1.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00362 Published 2025-05-08 No fix listed CWE-863

TI-2024-21385 CVE-2024-32493 · GHSA-j46p-v4gj-3jj5

An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16…

LOW 39

An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00708 Published 2024-04-29 No fix listed CWE-89

TI-2024-32631 CVE-2024-48938 · GHSA-pjf2-268r-g6x9

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email.

LOW 34

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2024-10-11 No fix listed CWE-1333

TI-2024-21384 CVE-2024-32492 · GHSA-c75w-9qpm-w8gc

An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the…

LOW 34

An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00532 Published 2024-04-29 No fix listed CWE-94

TI-2026-37303 CVE-2026-50592 · GHSA-fjc3-384j-842g

Cross-site scripting in Znuny

LOW 27

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view).

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00148 Published 2026-06-05 Fixed in 6.5.21, 7.3.3 CWE-79

TI-2025-28493 CVE-2025-43926 · GHSA-6mp7-r3w8-3vrm

An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6.

LOW 27

An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0024 Published 2025-05-08 No fix listed CWE-79

TI-2024-32630 CVE-2024-48937 · GHSA-q6x3-2mmr-2q9c

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS.

LOW 27

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00401 Published 2024-10-11 No fix listed CWE-79

TI-2026-37302 CVE-2026-50591 · GHSA-qfgf-x7qr-jq6q

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.

LOW 23

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00133 Published 2026-06-05 Fixed in 6.5.21, 7.3.3 CWE-79

TI-2026-54039 CVE-2026-77506 · GHSA-4mvf-wmjf-gpfv

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

LOW 22

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2026-08-20 Fixed in 6.5.22 CWE-79

Open these records in search →

Critical	6
High	5
Medium	5
Low	0
No CVSS	0