UpHeron
All vulnerabilities

Servers and applications

CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and…

Severity
Medium 6.1
Published
23 Oct 2026
Last changed
28 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Every version up to 10.1.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-93638
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93638