Zoom Workplace Apps XSS Vulnerability allows unauthenticated integrity loss
CVE-2025-27442 Published on April 8, 2025

Zoom Workplace Apps - Cross Site Scripting
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

NVD

Vulnerability Analysis

Attack Vector:

ADJACENT_NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2025-27442 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2025-27442

Want to know whenever a new CVE is published for Zoom? stack.watch will email you.

Zoom

Affected Versions

Zoom Communications, Inc Zoom Workplace Apps Version See references. is affected by CVE-2025-27442

Exploit Probability

EPSS

0.24%

Percentile

47.46%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.