Product by Apache Software Foundation

    Apache Syncope

    24 known vulnerabilities in Apache Syncope (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    24

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Syncope (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    HighCVE-2025-57738

    Apache Syncope: Remote Code Execution by delegated administrators

    		7.2
    CriticalCVE-2020-1959

    Apache Syncope: Template Injection

    		9.8
    CriticalCVE-2020-1961

    Apache Syncope: Template Injection

    		9.8
    HighCVE-2018-1321

    Apache Syncope: Code Execution

    		7.2
    CriticalCVE-2026-53421

    Apache Syncope: Remote Code Execution via Scripted Connector

    		9.8
    MediumCVE-2018-1322

    Apache Syncope: security vulnerability

    		4.9
    CriticalCVE-2026-57308

    Apache Syncope: SQL injection vulnerability in Audit Events search

    		9.8
    HighCVE-2020-11977

    Apache Syncope: Code Execution

    		7.2
    CriticalCVE-2026-63071

    Apache Syncope: RCE via Groovy Sandbox bypass

    		9.8
    CriticalCVE-2026-53405

    Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

    		9.8
    HighCVE-2018-17186

    Apache Syncope: Code Execution

    		7.2
    CriticalCVE-2026-62183

    Apache Syncope: User self-service privilege escalation

    		9.8
    MediumCVE-2026-23795

    Apache Syncope: Console XXE on Keymaster parameters

    		4.9
    HighCVE-2026-42782

    Apache Syncope: Post-auth RCE via Groovy static

    		7.2
    HighCVE-2026-62418

    Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

    		8.1
    Not ratedCVE-2014-3503

    Apache Syncope: security vulnerability

    		—
    MediumCVE-2019-17557

    Apache Syncope: security vulnerability

    		5.4
    HighCVE-2025-65998

    Apache Syncope: Default AES key used for internal password encryption

    		7.5
    MediumCVE-2018-17184

    Apache Syncope: security vulnerability

    		5.4
    MediumCVE-2026-23794

    Apache Syncope: Reflected XSS on Enduser Login

    		6.8
    Not ratedCVE-2014-0111

    Apache Syncope: security vulnerability

    		—
    MediumCVE-2026-42797

    Apache Syncope: JexlContextBuilder Information Disclosure

    		4.9
    MediumCVE-2024-45031

    Apache Syncope: Stored XSS in Console and Enduser

    		6.1
    MediumCVE-2024-38503

    Apache Syncope: HTML tags can be injected into Console or Enduser text fields

    		5.4

    All products by Apache Software Foundation