https://pwn.watch/t/sysaid Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 22 Jul 2025 00:00:00 GMT https://pwn.watch/i/sysaid-on-prem-cve-2025-2775 https://pwn.watch/i/sysaid-on-prem-cve-2025-2775 Tue, 22 Jul 2025 00:00:00 GMT critical <p>CVE-2025-2775: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. CVE-2025-2776: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. Added to CISA KEV on 2025-07-22.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-07-22: CISA added CVE-2025-2775 to the KEV catalog (due 2025-08-12).</li><li>2025-07-22: CISA added CVE-2025-2776 to the KEV catalog (due 2025-08-12).</li></ul> <p><strong>CVEs:</strong> CVE-2025-2775, CVE-2025-2776</p> https://pwn.watch/i/sysaid-server-cve-2023-47246 https://pwn.watch/i/sysaid-server-cve-2023-47246 Mon, 13 Nov 2023 00:00:00 GMT critical <p>SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution. Added to CISA KEV on 2023-11-13. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-11-13: CISA added CVE-2023-47246 to the KEV catalog (due 2023-12-04).</li></ul> <p><strong>CVEs:</strong> CVE-2023-47246</p>