Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

SysAid — Vulnerabilities & Security Advisories 15

Browse all 15 CVE security advisories affecting SysAid. AI-powered Chinese analysis, POCs, and references for each vulnerability.

SysAid serves as IT service management software helping organizations streamline IT operations and service desk functions. Historically, the platform has been vulnerable to multiple security issues including remote code execution, cross-site scripting, and privilege escalation vulnerabilities. These flaws often stem from improper input validation and access control weaknesses. While no major public security incidents have been widely documented, the 15 CVEs on record highlight consistent security challenges. The platform's web interface and integration points have been particularly susceptible to authentication bypass and information disclosure issues, requiring administrators to maintain rigorous patching protocols and secure configuration practices to mitigate potential exploitation risks.

CVE ID Title CVSS Severity Published
CVE-2025-2777 SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection — SysAid On-Prem CWE-611 9.3 Critical 2025-05-07
CVE-2025-2776 SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection — SysAid On-Prem CWE-611 9.3 Critical 2025-05-07
CVE-2025-2775 SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection — SysAid On-Prem CWE-611 9.3 Critical 2025-05-07
CVE-2024-36394 SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') — SysAid CWE-78 9.1 Critical 2024-06-06
CVE-2024-36393 SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') — SysAid CWE-89 9.9 Critical 2024-06-06
CVE-2024-27775 SysAid - CWE-918: Server-Side Request Forgery (SSRF) — SysAid CWE-918 7.2 High 2024-03-28
CVE-2023-32226 Sysaid - CWE-552: Files or Directories Accessible to External Parties — Sysaid CWE-552 8.3 High 2023-07-30
CVE-2023-32225 Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type — Sysaid CWE-434 9.8 Critical 2023-07-30
CVE-2022-23170 SysAid - Okta SSO integration — SysAid - Okta SSO integration CWE-611 5.9 Medium 2022-06-24
CVE-2022-23166 Sysaid – Sysaid Local File Inclusion (LFI) — Sysaid 6.1 Medium 2022-05-12
CVE-2022-23165 Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) — Sysaid CWE-79 5.5 Medium 2022-05-12
CVE-2022-22798 Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control — Sysaid 6.8 Medium 2022-05-12
CVE-2022-22797 Sysaid – sysaid Open Redirect — Sysaid CWE-601 4.6 Medium 2022-05-12
CVE-2022-22796 Sysaid – Sysaid System Takeover — Sysaid 7.0 High 2022-05-12
CVE-2021-36721 Sysaid - Sysaid API User Enumeration — SysAid API 4.4 Medium 2021-12-14

This page lists every published CVE security advisory associated with SysAid. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.