Zucchetti is an Italian enterprise software vendor offering a focused portfolio of human-resources, helpdesk, and unified-communications products that serve mid-market organizations. The vendor's vulnerability profile concentrates in a narrow product range—including HelpDesk Advanced, Ad Hoc Infinity, InfoBusiness, HR Portal, and Imagicle UC Suite—and recurs through web-application and file-handling weakness classes such as cross-site scripting, path traversal, cross-site request forgery, PHP remote file inclusion, and improper permission preservation. These weakness patterns reflect the vendor's position as a provider of internally deployed business applications where input validation, file access control, and session security are foundational concerns. Defenders should prioritize inventory of affected products in their estates and track updates from this vendor for the application-layer flaws that dominate its disclosure history. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Zucchetti over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-42369HIGH Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the C | Oct 14, 2021 | 8.8 | 29 | NO | NO |
CVE-2019-18206HIGH A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload. | Oct 30, 2019 | 8.8 | 26 | NO | NO |
CVE-2019-18204HIGH Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution. | Oct 30, 2019 | 8.8 | 25 | NO | NO |
CVE-2019-10257HIGH Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or d | Jun 19, 2019 | 7.5 | 24 | NO | NO |
CVE-2023-42225HIGH Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function. | Jan 13, 2025 | 7.5 | 23 | NO | NO |
CVE-2023-42231HIGH Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request to the "WSCView/Delet | Jan 13, 2025 | 8.1 | 22 | NO | NO |
CVE-2023-42228HIGH Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the "AclList | Jan 13, 2025 | 8.8 | 22 | NO | NO |
CVE-2023-42226HIGH Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function. | Jan 13, 2025 | 7.5 | 22 | NO | NO |
CVE-2025-61431MEDIUM A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows atta | Nov 4, 2025 | 6.1 | 21 | NO | NO |
CVE-2025-52180MEDIUM Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource par | Oct 30, 2025 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Zucchetti.
Media articles that mention a CVE ID that affects a product developed by Zucchetti — matched by CVE ID, not by vendor name.