Vendor
SysAid
15 known vulnerabilities.
SysAid at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 3 | 3 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
High max 9.3
Kwetsbaarheden verholpen in SysAid On-Prem
SysAid heeft kwetsbaarheden verholpen in SysAid On-Prem (Versies tot 23.3.40)
15 results · Feed
-
Critical 9.3CVE-2025-2777 EPSS 73%
SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
-
Critical 9.3
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
KEV Jul 22, 2025 -
Critical 9.3
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
KEV Jul 22, 2025 -
Critical 9.1
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
-
Critical 9.9
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
-
High 7.2
SysAid - CWE-918: Server-Side Request Forgery (SSRF)
SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash
-
High 8.3
Sysaid - CWE-552: Files or Directories Accessible to External Parties
Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method.
-
Critical 9.8
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.
-
Medium 5.9
SysAid - Okta SSO integration
SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration might be vulnerable. An unauthenticated attacker could exploit the XXE vulnerability by sending a ma…
-
Medium 6.1
Sysaid – Sysaid Local File Inclusion (LFI)
Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solutio…
-
Medium 5.5
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability…
-
Medium 6.8
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the pat…
-
Medium 4.6
Sysaid – sysaid Open Redirect
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a w…
-
High 7.0
Sysaid – Sysaid System Takeover
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.
-
Medium 4.4
Sysaid - Sysaid API User Enumeration
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server.