Security feed

24 October 2026

advisoryKnown exploited CVEOfficial CVE List24 Oct 2026

CVE-2018-6882

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

Announced 27 Mar 2018

n/a CVE-2018-6882

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2018-6882

n/a

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-6882
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2018-6882 · Unrated

Zimbra Collaboration Suite (ZCS) · Known exploited (CISA KEV)

Event: #7733 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:49:32 GMT
Publisher date: Tue, 27 Mar 2018 16:00:00 GMT

Read the original announcement