SysAid

Products

Exploited and recent CVEs

• CVE-2025-2776 Critical 9.3 Exploited SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection 64.7%
• CVE-2025-2775 Critical 9.3 Exploited SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection 42.6%
• CVE-2025-2777 Critical 9.3 SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection 72.9%
• CVE-2024-36394 Critical 9.1 SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 1.1%
• CVE-2024-36393 Critical 9.9 SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 0.4%
• CVE-2024-27775 High 7.2 SysAid - CWE-918: Server-Side Request Forgery (SSRF) 0.6%
• CVE-2023-32226 High 8.3 Sysaid - CWE-552: Files or Directories Accessible to External Parties 0.5%
• CVE-2023-32225 Critical 9.8 Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type 0.6%
• CVE-2022-23170 Medium 5.9 SysAid - Okta SSO integration 0.7%
• CVE-2022-23166 Medium 6.1 Sysaid – Sysaid Local File Inclusion (LFI) 1.1%
• CVE-2022-23165 Medium 5.5 Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) 0.4%
• CVE-2022-22798 Medium 6.8 Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control 0.6%
• CVE-2022-22797 Medium 4.6 Sysaid – sysaid Open Redirect 0.5%
• CVE-2022-22796 High 7.0 Sysaid – Sysaid System Takeover 1.4%
• CVE-2021-36721 Medium 4.4 Sysaid - Sysaid API User Enumeration 0.5%