OMENWAVE modelled vulnerability-chaining pathways

CVE-2023-34192

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

9.0
CVSS Critical
77.3%
EPSS p100
YES
In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
PRIV_ESC
Requires
USER access, NETWORK vector, user interaction
Grants
PRIV access
Capabilities
code executioncredential accessprivilege gaindata tampering
Model confidence
high · CVSS 3.1
Top plausible next hops
CVE-2022-27925PRIV_ESC → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated u…

CVE-2019-1003030PRIV_ESC → PRIV_ESChigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cp…

CVE-2024-21887PRIV_ESC → PRIV_ESChigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated…

CVE-2025-24016PRIV_ESC → PRIV_ESChigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, a…

CVE-2023-52163PRIV_ESC → PRIV_ESChigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer…

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2023-34192