Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: SysAid On-Prem — documentation.sysaid.com/docs/24-40-60 Clear all filters
TI-2025-02428 CVE-2025-2777 · GHSA-hxv5-fpm3-vhqh

SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection

Priority CRITICAL 86

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.72852 Published 2025-05-07 No fix listed CWE-611
TI-2025-02427 CVE-2025-2776 · GHSA-hvrh-gfrr-fgc9

SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

Priority CRITICAL 99KEV

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primit…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.65227 Published 2025-05-07 No fix listed CWE-611
TI-2025-02426 CVE-2025-2775 · GHSA-g3m4-2wr6-2q64

SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

Priority CRITICAL 97KEV

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitive…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.43173 Published 2025-05-07 No fix listed CWE-611