Manageengine
128 CVEs across 42 Manageengine products. Browse Manageengine vulnerabilities, severities, and proof-of-concept exploits.
Manageengine products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8309 | High | 8.1 | 2025-08-20 | There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter… |
CVE-2025-27930 | Medium | 6.4 | 2025-07-23 | Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor. |
CVE-2025-5966 | High | 8.1 | 2025-06-26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. |
CVE-2025-5366 | High | 8.1 | 2025-06-26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report. |
CVE-2025-41444 | High | 8.3 | 2025-06-09 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module. |
CVE-2025-41437 | Medium | 4.3 | 2025-06-09 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Ref… |
CVE-2025-3835 | Critical | 9.6 | 2025-06-09 | Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module. |
CVE-2025-36528 | High | 8.3 | 2025-06-09 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports. |
CVE-2025-27709 | High | 8.3 | 2025-06-09 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports. |
CVE-2025-41407 | High | 8.3 | 2025-05-23 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report. |
CVE-2025-36527 | High | 8.3 | 2025-05-23 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports. |
CVE-2025-41403 | High | 8.3 | 2025-05-22 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data. |
CVE-2025-3836 | High | 8.3 | 2025-05-22 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report. |
CVE-2025-3444 | Medium | 6.5 | 2025-05-22 | Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin… |
CVE-2025-3834 | High | 8.1 | 2025-05-14 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report. |
CVE-2025-3833 | High | 8.1 | 2025-05-14 | Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports. |
CVE-2024-50053 | Medium | 6.3 | 2025-03-21 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in… |
CVE-2025-1723 | High | 8.1 | 2025-03-03 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in th… |
CVE-2024-9097 | Low | 3.5 | 2025-02-05 | ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. |
CVE-2024-41140 | High | 8.1 | 2025-01-29 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. |
CVE-2024-52323 | High | 8.1 | 2024-11-27 | Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive t… |
CVE-2024-49574 | High | 8.3 | 2024-11-18 | Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module. |
CVE-2024-10839 | High | 8.5 | 2024-11-08 | Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. |
CVE-2024-24409 | High | 8.8 | 2024-11-08 | Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. |
CVE-2024-10203 | High | 7.0 | 2024-11-07 | Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed… |
CVE-2024-9459 | High | 8.3 | 2024-11-05 | Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in reports module. |
CVE-2024-36485 | High | 8.3 | 2024-11-04 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option. |
CVE-2024-48878 | High | 8.3 | 2024-11-04 | Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report. |
CVE-2024-5608 | High | 8.3 | 2024-10-24 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature. |
CVE-2024-9100 | Medium | 6.5 | 2024-10-03 | Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnerable to Path traversal. |
CVE-2024-38868 | High | 7.6 | 2024-08-30 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: befor… |
CVE-2024-6204 | High | 8.3 | 2024-08-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module. |
CVE-2024-5546 | High | 8.3 | 2024-08-28 | Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulne… |
CVE-2024-41150 | Medium | 6.3 | 2024-08-23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This… |
CVE-2024-38869 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Cen… |
CVE-2024-5586 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option. |
CVE-2024-5556 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module. |
CVE-2024-5490 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option. |
CVE-2024-5467 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report. |
CVE-2024-5466 | High | 8.8 | 2024-08-23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the… |
CVE-2024-36517 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module. |
CVE-2024-36516 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36515 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36514 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option. |
CVE-2024-5527 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration. |
CVE-2024-5487 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option. |
CVE-2024-36518 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard. |
CVE-2024-36035 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording. |
CVE-2024-36034 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option. |
CVE-2024-5678 | Medium | 4.7 | 2024-08-01 | Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. |
CVE-2024-6748 | High | 8.3 | 2024-07-29 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monit… |
CVE-2024-38872 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module. |
CVE-2024-38871 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module. |
CVE-2024-38870 | Low | 3.5 | 2024-07-17 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247… |
CVE-2024-5471 | High | 8.8 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. |
CVE-2024-27311 | Medium | 5.5 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the… |
CVE-2024-36038 | Medium | 6.3 | 2024-06-24 | Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy server option. |
CVE-2024-27313 | Medium | 6.3 | 2024-05-29 | Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610. |
CVE-2024-36037 | Medium | 5.5 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings. |
CVE-2024-36036 | Medium | 4.2 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent co… |
CVE-2024-27310 | Medium | 5.3 | 2024-05-27 | Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input. |
CVE-2024-27314 | Low | 2.4 | 2024-05-27 | Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in th… |
CVE-2024-21791 | Medium | 4.7 | 2024-05-22 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability. |
CVE-2023-49335 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details. |
CVE-2023-49334 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report. |
CVE-2023-49333 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature. |
CVE-2023-49332 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares. |
CVE-2023-49331 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option. |
CVE-2024-27312 | High | 8.1 | 2024-05-20 | Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This… |
CVE-2023-49330 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data. |
CVE-2024-21775 | High | 8.3 | 2024-02-16 | Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature. |
CVE-2024-0269 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and re… |
CVE-2024-0253 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data. |
CVE-2024-0252 | High | 8.8 | 2024-01-11 | ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component… |
CVE-2023-47211 | Critical | 9.1 | 2024-01-08 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbi… |
CVE-2023-6105 | Medium | 5.5 | 2023-11-15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user wit… |
CVE-2023-4769 | Medium | 6.6 | 2023-11-03 | A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability coul… |
CVE-2023-4768 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4767 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-35719 | Medium | 6.8 | 2023-09-06 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physi… |
CVE-2022-43473 | Medium | 5.8 | 2023-03-30 | A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can… |
CVE-2020-19554 | Medium | 6.1 | 2021-09-21 | Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload. |
CVE-2021-28960 | Critical | 9.8 | 2021-09-21 | Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand oper… |
CVE-2018-15608 | Medium | 6.1 | 2018-08-28 | Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen. |
CVE-2016-9498 | Critical | 9.8 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote use… |
CVE-2016-9491 | Medium | 4.9 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to ad… |
CVE-2016-9489 | High | 8.8 | 2018-07-13 | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e… |
CVE-2016-9490 | Medium | 6.1 | 2018-06-05 | ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is pro… |
CVE-2016-9488 | Critical | 9.8 | 2018-06-05 | ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able t… |
CVE-2017-11512 | High | 7.5 | 2017-11-08 | The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the… |
CVE-2017-11511 | High | 7.5 | 2017-11-08 | The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for… |
CVE-2015-8249 | Critical | 9.8 | 2017-09-28 | The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the Connecti… |
CVE-2014-5302 | High | 8.8 | 2017-08-28 | Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4… |
CVE-2014-5301 | High | 8.8 | 2017-08-28 | Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. |
CVE-2015-1480 | | 2015-02-04 | ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData… | |
CVE-2014-9373 | | 2014-12-16 | Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code vi… | |
CVE-2014-9372 | | 2014-12-16 | Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to dele… | |
CVE-2014-3996 | | 2014-12-05 | SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) editio… | |
CVE-2014-8678 | | 2014-11-25 | The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFi… | |
CVE-2014-8499 | | 2014-11-17 | Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 b… |