Zoho
14 CVEs across 9 Zoho products. Browse Zoho vulnerabilities, severities, and proof-of-concept exploits.
Zoho products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37225 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketi… |
CVE-2024-32442 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7. |
CVE-2024-32441 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7. |
CVE-2021-42956 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper pri… |
CVE-2021-33849 | Medium | 5.4 | 2021-10-05 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The a… |
CVE-2016-1159 | Medium | 6.5 | 2020-03-09 | In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password… |
CVE-2019-19306 | Medium | 5.4 | 2019-11-26 | The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. |
CVE-2019-15645 | High | 8.8 | 2019-08-27 | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. |
CVE-2019-15644 | Medium | 6.1 | 2019-08-27 | The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS. |
CVE-2019-5963 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via un… |
CVE-2019-5962 | Medium | 6.1 | 2019-07-05 | Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-11512 | High | 7.5 | 2017-11-08 | The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the… |
CVE-2017-11511 | High | 7.5 | 2017-11-08 | The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for… |
CVE-2014-6686 | | 2014-09-23 | The Zoho Books - Accounting App (aka com.zoho.books) application 3.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the… |