CVE-2025-2776

CRITICAL
2025-05-07 [email protected]
9.3
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 18:40 vuln.today
Added to CISA KEV
Oct 27, 2025 - 16:58 cisa
CISA KEV
PoC Detected
Oct 27, 2025 - 16:58 vuln.today
Public exploit code
CVE Published
May 07, 2025 - 15:15 nvd
CRITICAL 9.3

Tags

XXE Sysaid

Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Analysis

SysAid On-Prem contains a second unauthenticated XXE injection in Server URL processing, providing an alternative attack path to the Checkin XXE (CVE-2025-2775) for admin takeover.

Technical Context

The CWE-611 XXE in Server URL XML processing provides a second exploitation vector for file reading and admin account compromise.

Affected Products

['SysAid On-Prem through 23.3.40']

Remediation

Apply SysAid updates addressing both XXE vulnerabilities. Implement comprehensive XML parsing hardening.

Priority Score

179
Low Medium High Critical
KEV: +50
EPSS: +62.6
CVSS: +46
POC: +20

Share

CVE-2025-2776 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy