CVE-2023-45207

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)

• CWE-79
• CWE-79

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Feb 13, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45201Online Examination System v1.0 is vulnerable to multiple Ope…6.1
• CVE-2023-45202Online Examination System v1.0 is vulnerable to multiple Ope…6.1
• CVE-2023-45203Online Examination System v1.0 is vulnerable to multiple Ope…6.1
• CVE-2023-45204A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-45205A vulnerability has been identified in SICAM PAS/PQS (All ve…7.8
• CVE-2023-45206An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15…6.1
• CVE-2023-45208A command injection in the parsing_xml_stasurvey function in…8.8
• CVE-2023-45209An information disclosure vulnerability exists in the web in…7.5
• CVE-2023-4521The Import XML and RSS Feeds WordPress plugin before 2.1.5 c…9.8
• CVE-2023-45210Pleasanter 1.3.47.0 and earlier contains an improper access …4.3
• CVE-2023-45213 A potential attacker with access to the Westermo Lynx…6.5
• CVE-2023-45215A stack-based buffer overflow vulnerability exists in the bo…7.2