Actively exploited vulnerabilities affecting SysAid products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-2775https://wildfortech.com/security#CVE-2025-2775SysAid On-Prem's check-in processing functionality fails to properly restrict XML External Entity (XXE) references, a class of vulnerability where an attacker can manipulate XML parsing to access files on the server or trigger actions it shouldn't. In this case, exploitation can lead to full administrator account takeover and the ability to read arbitrary files — meaning an attacker could seize control of the SysAid platform and exfiltrate sensitive data from the underlying system.Tue, 22 Jul 2025 00:00:00 GMTSysAidSysAid On-Premhttps://wildfortech.com/security#CVE-2025-2776https://wildfortech.com/security#CVE-2025-2776SysAid On-Prem's Server URL processing functionality fails to properly restrict XML External Entity (XXE) references, a class of vulnerability that lets attackers manipulate how the application parses XML input. In this case, exploitation can lead to full administrator account takeover and the ability to read arbitrary files from the server. Any organization running SysAid on-premises is at risk of complete system compromise through this flaw, making it a critical priority.Tue, 22 Jul 2025 00:00:00 GMTSysAidSysAid On-Prem