CyberSec.Space Logo
Back to CVE Browser

CVE-2025-2775

🔥 Known Exploited (CISA KEV)CRITICAL
9.3
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-05-07
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

Affected Platforms (CPE)

📦
Sysaid

Sysaid

<= 23.3.40

References & Advisories

🔗 https://documentation.sysaid.com/docs/24-40-60
🔗 https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
🔗 https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2775

Related Vulnerabilities

CVE-2025-27779.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw proces...

CVE-2025-27769.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL ...

CVE-2024-363949.1

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-363939.9

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')