CVE-2025-2777

<= 23.3.40

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw proces

9.3CRITICAL

CVE-2025-2776

<= 23.3.40

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL

9.3CRITICAL

CVE-2025-2775

<= 23.3.40

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin pro

9.3CRITICAL

CVE-2024-36394

<= 23.3.38

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

9.1CRITICAL

CVE-2024-36393

<= 23.3.38

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

9.9CRITICAL

CVE-2023-47247

< 23.3.34

In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bu

4.3MEDIUM

CVE-2023-33706

< 23.2.50

SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtm

6.5MEDIUM

CVE-2023-47246

< 23.3.36

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the

9.8CRITICAL

CVE-2023-32226

< 23.2.14

Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the serv

8.3HIGH

CVE-2023-32225

< 23.2.14

Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able

9.8CRITICAL

CVE-2022-40325

< 22.1.65

SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.

6.1MEDIUM

CVE-2022-40324

< 22.1.65

SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.

6.1MEDIUM

CVE-2022-40323

< 22.1.65

SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.

6.1MEDIUM

CVE-2022-40322

< 22.1.65

SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.

6.1MEDIUM

CVE-2022-23170

>= 22.1.49 and <= 22.1.63

SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that u

5.9MEDIUM

CVE-2022-23166

< 22.2.20

Sysaid - Sysaid Local File Inclusion (LFI) - An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/ex

6.1MEDIUM

CVE-2022-23165

< 22.2.20

Sysaid - Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp

5.5MEDIUM

CVE-2022-22798

< 21.1.50

Sysaid - Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to

6.8MEDIUM

CVE-2022-22797

< 22.1.50

Sysaid - sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the

4.6MEDIUM

CVE-2022-22796

< 21.1.30

Sysaid - Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /Con

7.0HIGH

CVE-2021-43974

all versions

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does n

5.3MEDIUM

CVE-2021-43973

all versions

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker t

8.8HIGH

CVE-2021-43972

all versions

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated a

6.5MEDIUM

CVE-2021-43971

all versions

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to exec

8.8HIGH

CVE-2021-36721

< 21.3.60

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version coul

4.4MEDIUM

CVE-2021-31862

all versions

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.

6.1MEDIUM

CVE-2021-30486

all versions

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementCh

8.8HIGH

CVE-2021-30049

all versions

SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.

6.1MEDIUM

CVE-2020-13168

all versions

SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.

6.1MEDIUM

CVE-2020-10569

all versions

SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it al

9.8CRITICAL

CVE-2015-3001

<= 15.1

SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remot

CVE-2015-3000

<= 15.1

SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number

CVE-2015-2999

<= 15.1

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL comman

CVE-2015-2998

<= 15.1

SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive infor

CVE-2015-2997

<= 15.1

SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid paramet

CVE-2015-2996

<= 15.1

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files vi

CVE-2015-2995

<= 15.1

The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to

CVE-2015-2994

<= 15.1

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute

CVE-2015-2993

<= 15.1

SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) crea

CVE-2014-9436

<= 14.4

Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\\

CVE-2008-2179

all versions

Cross-site scripting (XSS) vulnerability in SystemList.jsp in SysAid 5.1.08 allows remote attackers to inject arbitrary web script

CVE-2007-5259

all versions

Cross-site request forgery (CSRF) vulnerability in Ilient SysAid 4.5.03 and 4.5.04 allows remote attackers to perform some actions