Zimbra patches critical XSS flaw in Classic Web Client

Zimbra released version 10.1.19 to patch a critical stored cross‑site scripting vulnerability in the Classic Web Client. Specially crafted emails can execute malicious code when opened, potentially stealing session data, account settings, or mailbox information. The flaw was reported by Google's Threat Analysis Group and has no CVE ID yet.