Sysaid

3 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2025-2777 CRITICAL POC THREAT Emergency

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 24.6%.

XXE Sysaid

NVD

CVSS 3.1

9.3

EPSS

24.6%

CVE-2025-2776 CRITICAL POC KEV THREAT Emergency

SysAid On-Prem contains a second unauthenticated XXE injection in Server URL processing, providing an alternative attack path to the Checkin XXE (CVE-2025-2775) for admin takeover.

XXE Sysaid

NVD

CVSS 3.1

9.3

EPSS

62.6%

CVE-2025-2775 CRITICAL POC KEV THREAT Emergency

SysAid On-Prem versions through 23.3.40 contain an unauthenticated XXE injection in the Checkin processing, enabling administrator account takeover and file read primitives.

XXE Sysaid

NVD

CVSS 3.1

9.3

EPSS

69.8%

CVE-2025-2777

EPSS 25% CVSS 9.3

CRITICAL POC THREAT Emergency

XXE Sysaid

NVD

CVE-2025-2776

EPSS 63% CVSS 9.3

CRITICAL POC KEV THREAT Emergency

SysAid On-Prem contains a second unauthenticated XXE injection in Server URL processing, providing an alternative attack path to the Checkin XXE (CVE-2025-2775) for admin takeover.

XXE Sysaid

NVD

CVE-2025-2775

EPSS 70% CVSS 9.3

CRITICAL POC KEV THREAT Emergency

SysAid On-Prem versions through 23.3.40 contain an unauthenticated XXE injection in the Checkin processing, enabling administrator account takeover and file read primitives.

XXE Sysaid

NVD