Login Request a demo
SY
Vendor
Sysaid
10 products with CVEs on record
45
CVEs
7
On KEV
0
New 30D
Products
SY
Sysaid
Sysaid
9.8
29 CVEs3 on KEV0 new
SO
SysAid On-Prem
SysAid
9.8
2 CVEs2 on KEV0 new
SO
Sysaid On-premises
Sysaid
9.8
4 CVEs1 on KEV0 new
SS
SysAid Server
SysAid
9.8
1 CVEs1 on KEV0 new
HD
Help Desk
Sysaid
6.1
4 CVEs0 on KEV0 new
AP
Application Programming Interface
Sysaid
5.3
1 CVEs0 on KEV0 new
IT
Itil
Sysaid
5.3
1 CVEs0 on KEV0 new
OS
Okta Sso
Sysaid
9.8
1 CVEs0 on KEV0 new
ON
On-premise
Sysaid
9.8
1 CVEs0 on KEV0 new
SO
Sysaidsy On-premises
Sysaid
6.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-2777
SY
Sysaid
Sysaid
9.8
73%
May 7SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator…
CVE-2025-2776
In wildKEV
SO
SysAid On-Prem
SysAid
9.8
65%
May 7SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
CVE-2025-2775
In wildKEV
SO
SysAid On-Prem
SysAid
7.5
43%
May 7SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
CVE-2024-36394
SY
Sysaid
Sysaid
9.8
1%
Jun 6SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-36393
SY
Sysaid
Sysaid
9.8
0%
Jun 6SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-47247
SY
Sysaid
Sysaid
4.3
0%
Dec 25In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102
CVE-2023-33706
SY
Sysaid
Sysaid
6.5
1%
Nov 24SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to…
CVE-2023-47246
RansomwareIn wildKEV
SY
Sysaid
Sysaid
9.8
99%
Nov 10SysAid Server Path Traversal Vulnerability
CVE-2023-32226
SO
Sysaid On-premises
Sysaid
6.5
1%
Jul 30Sysaid - CWE-552: Files or Directories Accessible to External Parties -  Authenticated users may exfiltrate files from the server via an unspecified method
CVE-2023-32225
SO
Sysaid On-premises
Sysaid
7.2
1%
Jul 30Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -  A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified…
CVE-2022-40325
HD
Help Desk
Sysaid
6.1
0%
Sep 11SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262
CVE-2022-40324
HD
Help Desk
Sysaid
6.1
0%
Sep 11SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258
CVE-2022-40323
HD
Help Desk
Sysaid
6.1
0%
Sep 11SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241
CVE-2022-40322
HD
Help Desk
Sysaid
6.1
0%
Sep 11SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579
CVE-2022-23170
OS
Okta Sso
Sysaid
9.8
1%
Jun 24SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability
CVE-2022-23166
SY
Sysaid
Sysaid
9.8
1%
May 12Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path
CVE-2022-23165
SY
Sysaid
Sysaid
6.1
0%
May 12Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting…
CVE-2022-22798
SY
Sysaid
Sysaid
8.8
1%
May 12Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects…
CVE-2022-22797
SY
Sysaid
Sysaid
6.1
1%
May 12Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location:…
CVE-2022-22796
SY
Sysaid
Sysaid
9.8
1%
May 12Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button,…
CVE-2021-43974
IT
Itil
Sysaid
5.3
1%
Jan 11An issue was discovered in SysAid ITIL 20.4.74 b10
CVE-2021-43973
SY
Sysaid
Sysaid
8.8
2%
Jan 11An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter…
CVE-2021-43972
SY
Sysaid
Sysaid
6.5
1%
Jan 11An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server…
CVE-2021-43971
SY
Sysaid
Sysaid
8.8
2%
Jan 11A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText…
CVE-2021-36721
AP
Application Programming Interface
Sysaid
5.3
0%
Dec 14Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server
CVE-2021-31862
SY
Sysaid
Sysaid
6.1
4%
Oct 29SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication
CVE-2021-30486
SY
Sysaid
Sysaid
8.8
1%
Jul 22SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp…
CVE-2021-30049
SY
Sysaid
Sysaid
6.1
2%
Jul 22SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI
CVE-2020-13168
SO
Sysaid On-premises
Sysaid
6.1
1%
Oct 2SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter
CVE-2020-10569
ON
On-premise
Sysaid
9.8
3%
Apr 21SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack
CVE-2015-3001
SY
Sysaid
Sysaid
–
7%
Jun 8SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access…
CVE-2015-3000
SY
Sysaid
Sysaid
–
8%
Jun 8SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an XML document to…
CVE-2015-2999
SY
Sysaid
Sysaid
–
2%
Jun 8Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an…
CVE-2015-2998
SY
Sysaid
Sysaid
–
26%
Jun 8SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the…
CVE-2015-2997
SY
Sysaid
Sysaid
–
57%
Jun 8SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large…
CVE-2015-2996
SY
Sysaid
Sysaid
–
87%
Jun 8Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a
CVE-2015-2995
SY
Sysaid
Sysaid
–
34%
Jun 8The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL…
CVE-2015-2994
SY
Sysaid
Sysaid
–
50%
Jun 8Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp…
CVE-2015-2993
SY
Sysaid
Sysaid
–
55%
Jun 8SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request…
CVE-2014-9436
SY
Sysaid
Sysaid
–
7%
Jan 2Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\\\ (four backslashes) in the fileName parameter to…