Syncope

Vendor:

First CVE: Apr 17, 2014 · Active for 12 years

18
Total CVEs
More Total CVEs than 93% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 32% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Syncope over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 17, 2014
12 years ago
Most Recent CVE
May 25, 2026
60 days ago

CVE Severity & Scoring

Syncope18 CVEs
All CVEs352,231 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network16 (88.9%)
Unknown2 (11.1%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low16 (88.9%)
High0 (0.0%)
Unknown2 (11.1%)
User Interaction
None11 (61.1%)
Unknown2 (11.1%)
Required5 (27.8%)
Privileges Required
Low4 (22.2%)
High8 (44.4%)
None4 (22.2%)
Unknown2 (11.1%)

Top CVEs

Signals from CVEs in this product scope (18 CVEs).

18 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2018-1321HIGH
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affecte
Mar 20, 20187.244NOYES
CVE-2025-57738HIGH
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implement
Oct 20, 20257.240NONO
CVE-2018-1322MEDIUM
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can r
Mar 20, 20184.938NOYES
CVE-2020-1959CRITICAL
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Co
May 4, 20209.833NONO
CVE-2026-42782HIGH
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class con
May 25, 20267.228NONO
CVE-2020-1961CRITICAL
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arb
May 4, 20209.828NONO
CVE-2026-23794MEDIUM
Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that us
Feb 3, 20266.824NONO
CVE-2025-65998HIGH
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the
Nov 24, 20257.524NONO
CVE-2018-17186HIGH
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
Nov 6, 20187.224NONO
CVE-2026-42797MEDIUM
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL
May 25, 20264.923NONO
View all 18 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (18 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
11.1% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (18 CVEs).

Media Mentions

Signals from CVEs in this product scope (18 CVEs).

Top CNAs Publishing CVEs For Syncope

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
4.1.026.00.5%00
1.2.017.218.0%01
1.1.826.019.3%02
1.1.735.714.8%02
1.1.635.714.8%02
1.1.535.714.8%02
1.1.435.714.8%02
1.1.335.714.8%02
1.1.235.714.8%02
1.1.135.714.8%02
1.1.035.714.8%02
1.0.926.019.3%02
1.0.826.019.3%02
1.0.726.019.3%02
1.0.626.019.3%02
1.0.526.019.3%02
1.0.426.019.3%02
1.0.314.920.5%01
1.0.026.019.3%02