SY
Product
Sysaid
On CISA KEVExploited in the wildRansomware-linked
29
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 5Medium 7Low 0
Watch
Add Sysaid to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-2776 In wildKEV | 9.8 | May 7 | SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection Affected: through 23.3.40 |
| CVE-2023-47246 RansomwareIn wildKEV | 9.8 | Nov 10 | SysAid Server Path Traversal Vulnerability Affected: before 23.3.36 |
| CVE-2025-2777 | 9.8 | May 7 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator… Affected: through 23.3.40 |
| CVE-2024-36394 | 9.8 | Jun 6 | SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Affected: through 23.3.38 |
| CVE-2024-36393 | 9.8 | Jun 6 | SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affected: through 23.3.38 |
| CVE-2022-23166 | 9.8 | May 12 | Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path Affected: before 22.1.64; before 22.2.20 |
| CVE-2022-22796 | 9.8 | May 12 | Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button,… Affected: before 21.1.30; before 21.4.45 |
Showing 7