Search: CVE-2025-66376

CVE-2025-66376 is a high-severity stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) versions 10.0 before 10.0.18 and 10.1 before 10.1.13. It allows an attacker to inject malicious CSS @import directives via HTML email messages in the Classic UI, leading to improper input neutralization during web page generation. This vulnerability can be exploited remotely without authentication and does not require user interaction. It impacts confidentiality and integrity but not availability. Known exploits exist in the wild.