CVE Daily

CVE-2025-2776

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML Exte...

Critical CVSS 9.3

Overview

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

CWE: CWE-611 Published: 2025-05-07T15:15:57.573
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.3 (CRITICAL)
  • Detected tags: xxe (tag impact: MODERATE)

Recommended actions:

  • Disable external entities in XML parsers; use safe libraries.

Recommended tools

Tags