zammad records

90 published records for vendor zammad.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 5
With a fix record: 14.4%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

90 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2021-42090No exploit	An issue was discovered in Zammad before 4.1.1.zammad · zammad · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	2.3%	Oct 7, 2021
40Plan	CVE-2021-42094No exploit	An issue was discovered in Zammad before 4.1.1.zammad · zammad · CWE-77 pre-auth RCE Command injection	Critical9.8	—	1.9%	Oct 7, 2021
39Monitor	CVE-2017-5619No exploit	An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.zammad · zammad · CWE-287 Pre-auth Auth bypass	Critical9.8	—	1.5%	Mar 13, 2017
39Monitor	CVE-2020-26030No exploit	An issue was discovered in Zammad before 3.4.1.zammad · zammad · CWE-287 Pre-auth Auth bypass	Critical9.8	—	1.4%	Dec 28, 2020
39Monitor	CVE-2022-48021No exploit	A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.zammad · zammad pre-auth RCE	Critical9.8	—	0.9%	Feb 2, 2023
39Monitor	CVE-2022-35490No exploit	Zammad 5.2.0 is vulnerable to privilege escalation.zammad · zammad · CWE-307 Pre-auth	Critical9.8	—	0.9%	Aug 8, 2022
39Monitor	CVE-2017-6080No exploit	An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involvizammad · zammad · CWE-352 Pre-auth CSRF	Critical9.8	—	0.7%	Mar 13, 2017
36Monitor	CVE-2022-27332No exploit	An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.zammad · zammad · CWE-306 Pre-auth Auth bypass	Critical9.1	—	1.1%	Apr 26, 2022
36Monitor	CVE-2021-42091No exploit	An issue was discovered in Zammad before 4.1.1.zammad · zammad · CWE-918 Pre-auth SSRF	Critical9.1	—	1.1%	Oct 7, 2021
36Monitor	CVE-2024-33668No exploit	An issue was discovered in Zammad before 6.3.0.zammad · zammad · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Apr 25, 2024
35Monitor	CVE-2021-42086No exploit	An issue was discovered in Zammad before 4.1.1.zammad · zammad	High8.8	—	1.1%	Oct 7, 2021
35Monitor	CVE-2017-6081No exploit	A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.zammad · zammad · CWE-352 Pre-auth CSRF	High8.8	—	0.6%	Mar 13, 2017
35Monitor	CVE-2025-32359No exploit	In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.zammad · zammad · CWE-602	High8.8	—	0.3%	Apr 5, 2025
34Monitor	CVE-2026-34723No exploit	Zammad has incorrect access control in getting_started_controllerzammad · zammad · CWE-284 Pre-auth Broken access control (IDOR)	High8.7	—	0.5%	Apr 8, 2026
34Monitor	CVE-2024-33666No exploit	An issue was discovered in Zammad before 6.3.0.zammad · zammad · CWE-284 Pre-auth Broken access control (IDOR)	High8.6	—	0.5%	Apr 25, 2024
34Monitor	CVE-2026-34724Proof of concept	Zammad has a server-side template injection leading to RCE via AI Agentzammad · zammad · CWE-94 RCE SSTI	High8.7	—	0.5%	Apr 8, 2026
33Monitor	CVE-2026-34719No exploit	Zammad has a Server-side request forgery (SSRF) via webhookszammad · zammad · CWE-918 SSRF	High8.3	—	0.3%	Apr 8, 2026
32Monitor	CVE-2021-43145No exploit	With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.zammad · zammad	High8.1	—	1.0%	Feb 4, 2022
32Monitor	CVE-2025-32360No exploit	In Zammad 6.4.x before 6.4.2, there is information exposure.zammad · zammad · CWE-402	High8.1	—	0.2%	Apr 5, 2025
30Monitor	CVE-2020-10096No exploit	An issue was discovered in Zammad 3.0 through 3.2.zammad · zammad · CWE-200 Pre-auth Info leak	High7.5	—	1.1%	Mar 4, 2020
30Monitor	CVE-2021-35299No exploit	Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration prozammad · zammad · CWE-532 Pre-auth Info leak	High7.5	—	1.1%	Jun 28, 2021
30Monitor	CVE-2021-42089No exploit	An issue was discovered in Zammad before 4.1.1.zammad · zammad · CWE-200 Pre-auth Info leak	High7.5	—	1.1%	Oct 7, 2021
30Monitor	CVE-2020-10101No exploit	An issue was discovered in Zammad 3.0 through 3.2.zammad · zammad · CWE-20 Pre-auth Denial of service	High7.5	—	1.1%	Mar 4, 2020
30Monitor	CVE-2020-26032No exploit	An SSRF issue was discovered in Zammad before 3.4.1.zammad · zammad · CWE-918 Pre-auth SSRF	High7.5	—	1.1%	Dec 28, 2020
30Monitor	CVE-2022-29701No exploit	A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests forzammad · zammad · CWE-770 Pre-auth Denial of service	High7.5	—	1.0%	Apr 26, 2022

CVE-2021-42090
40Plan
An issue was discovered in Zammad before 4.1.1.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Deserialization
zammad · zammadOct 7, 2021
CVE-2021-42094
40Plan
An issue was discovered in Zammad before 4.1.1.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Command injection
zammad · zammadOct 7, 2021
CVE-2017-5619
39Monitor
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Auth bypass
zammad · zammadMar 13, 2017
CVE-2020-26030
39Monitor
An issue was discovered in Zammad before 3.4.1.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
zammad · zammadDec 28, 2020
CVE-2022-48021
39Monitor
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
zammad · zammadFeb 2, 2023
CVE-2022-35490
39Monitor
Zammad 5.2.0 is vulnerable to privilege escalation.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
zammad · zammadAug 8, 2022
CVE-2017-6080
39Monitor
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involvi
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- CSRF
zammad · zammadMar 13, 2017
CVE-2022-27332
36Monitor
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Auth bypass
zammad · zammadApr 26, 2022
CVE-2021-42091
36Monitor
An issue was discovered in Zammad before 4.1.1.
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- SSRF
zammad · zammadOct 7, 2021
CVE-2024-33668
36Monitor
An issue was discovered in Zammad before 6.3.0.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
zammad · zammadApr 25, 2024
CVE-2021-42086
35Monitor
An issue was discovered in Zammad before 4.1.1.
HighCVSS 8.8No exploitEPSS 1%
zammad · zammadOct 7, 2021
CVE-2017-6081
35Monitor
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1.
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- CSRF
zammad · zammadMar 13, 2017
CVE-2025-32359
35Monitor
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.
HighCVSS 8.8No exploitEPSS 0%
zammad · zammadApr 5, 2025
CVE-2026-34723
34Monitor
Zammad has incorrect access control in getting_started_controller
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
zammad · zammadApr 8, 2026
CVE-2024-33666
34Monitor
An issue was discovered in Zammad before 6.3.0.
HighCVSS 8.6No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
zammad · zammadApr 25, 2024
CVE-2026-34724
34Monitor
Zammad has a server-side template injection leading to RCE via AI Agent
HighCVSS 8.7Proof of conceptEPSS 0%
- RCE
- SSTI
zammad · zammadApr 8, 2026
CVE-2026-34719
33Monitor
Zammad has a Server-side request forgery (SSRF) via webhooks
HighCVSS 8.3No exploitEPSS 0%
- SSRF
zammad · zammadApr 8, 2026
CVE-2021-43145
32Monitor
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
HighCVSS 8.1No exploitEPSS 1%
zammad · zammadFeb 4, 2022
CVE-2025-32360
32Monitor
In Zammad 6.4.x before 6.4.2, there is information exposure.
HighCVSS 8.1No exploitEPSS 0%
zammad · zammadApr 5, 2025
CVE-2020-10096
30Monitor
An issue was discovered in Zammad 3.0 through 3.2.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
zammad · zammadMar 4, 2020
CVE-2021-35299
30Monitor
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration pro
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
zammad · zammadJun 28, 2021
CVE-2021-42089
30Monitor
An issue was discovered in Zammad before 4.1.1.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
zammad · zammadOct 7, 2021
CVE-2020-10101
30Monitor
An issue was discovered in Zammad 3.0 through 3.2.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
zammad · zammadMar 4, 2020
CVE-2020-26032
30Monitor
An SSRF issue was discovered in Zammad before 3.4.1.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- SSRF
zammad · zammadDec 28, 2020
CVE-2022-29701
30Monitor
A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
zammad · zammadApr 26, 2022