SysAid On-Prem vulnerabilities

Latest SysAid On-Prem CVEs

Newest publication first

1. CVE-2025-2777 SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection

   Published 2025-05-07

   Critical·CVSS 9.8 EPSS 72.9%

   SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

2. CVE-2025-2776 SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

   Published 2025-05-07

   Critical·CVSS 9.8 EPSS 65.2% CISA KEV added 2025-07-22 Exploited in the wild

   SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

3. CVE-2025-2775 SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

   Published 2025-05-07

   High·CVSS 7.5 EPSS 43.2% CISA KEV added 2025-07-22 Exploited in the wild

   SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.