Skip to content
OpenAdvisories

Vendor

SysAid

15 known vulnerabilities.

Products

SysAid 10 SysAid On-Prem 3 SysAid API 1 SysAid - Okta SSO integration 1 On-Prem 0
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-2777 EPSS 73%

    SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
  • Critical 9.3
    CVE-2025-2776 Exploited Public exploit EPSS 65%

    SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.3
    CVE-2025-2775 Exploited Public exploit EPSS 43%

    SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.1
    CVE-2024-36394

    SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    SysAid SysAid
  • Critical 9.9
    CVE-2024-36393

    SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    SysAid SysAid
  • Critical 9.8
    CVE-2023-32225

    Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type

    Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -  A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.

    SysAid SysAid