Apache · product
Apache Syncope
49 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 3
Every one of the 49 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Syncope: Remote Code Execution by delegated administrators
- An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can…
- An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affect…
- A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote C…
- Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject ar…
- In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicio…
- An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
- Apache Syncope: Console XXE on Keymaster parameters
- It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could exe…
- A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and P…
- Apache Syncope: Remote Code Execution via Scripted Connector
- Apache Syncope: User self-service privilege escalation
- Apache Syncope: SQL injection vulnerability in Audit Events search
- Apache Syncope: RCE via Groovy Sandbox bypass
- Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
- Apache Syncope: Stored XSS in Console and Enduser
- Apache Syncope: HTML tags can be injected into Console or Enduser text fields
- Apache Syncope: Post-auth RCE via Groovy static
- Apache Syncope: Privilege escalation for admin user via JWT authentication
- Apache Syncope: Incomplete authorization checks for Group members deprovisioning
- Apache Syncope: SQL injection via sort parameter in Task search
- Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
- Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
- Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
- Apache Syncope: JWT subject spoofing
- Apache Syncope: Default AES key used for internal password encryption
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.