← CVE Radar
CVE-2025-2776SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
9.3 CRITICALEPSS 65.22%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
Details
- CVE ID
- CVE-2025-2776
- Status
- Published
- Assigner (CNA)
- VulnCheck
- Published
- May 7, 2025
- Last modified
- 2025-11-19 18:33 UTC
- Weaknesses
- CWE-611 · Improper Restriction of XML External Entity Reference
Affected Products
As published by the CNA in the CVE record.
SysAidSysAid On-Prem1 version range
- through 23.3.40
References
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS