XSS in Zohocorp Manageengine Adselfservice Plus
CVE-2010-3274
Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.210 (97.3th percentile) — read the EPSS interpretation.
Affected products
- Zohocorp Manageengine_adselfservice_plus
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_OSVDB, Exploit, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_OSVDB, Exploit, vdb-entry)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)