CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

User privilege escalation vulnerability

There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.

CWE-269Aug 20, 2025
CVSS8.1v3.1EPSS0.256%PoCs0SignalsSTIX

Stored XSS

Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.

CWE-79Jul 23, 2025
CVSS6.4v3.1EPSS0.405%PoCs0SignalsSTIX

Stored XSS

Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.

CWE-79Jun 26, 2025
CVSS8.1v3.1EPSS1.1%PoCs0SignalsSTIX

Stored XSS

Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.

CWE-79Jun 26, 2025
CVSS8.1v3.1EPSS1.1%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.

CWE-89Jun 9, 2025
CVSS8.3v3.1EPSS1.28%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports.

CWE-89Jun 9, 2025
CVSS8.3v3.1EPSS1.28%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.

CWE-89Jun 9, 2025
CVSS8.3v3.1EPSS1.28%PoCs0SignalsSTIX

Reflected XSS

Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.

CWE-79Jun 9, 2025
CVSS4.3v3.1EPSS0.215%PoCs0SignalsSTIX

Remote Code Execution

Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.

CWE-434Jun 9, 2025
CVSS9.6v3.1EPSS1.99%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.

CWE-89May 23, 2025
CVSS8.3v3.1EPSS1.33%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.

CWE-89May 23, 2025
CVSS8.3v3.1EPSS31%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.

CWE-89May 22, 2025
CVSS8.3v3.1EPSS1.59%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.

CWE-89May 22, 2025
CVSS8.3v3.1EPSS5.36%PoCs0SignalsSTIX

Local File Inclusion

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

CWE-434May 22, 2025
CVSS6.5v3.1EPSS1.43%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.

CWE-89May 14, 2025
CVSS8.1v3.1EPSS1.5%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.

CWE-89May 14, 2025
CVSS8.1v3.1EPSS38.4%PoCs0SignalsSTIX

Stored XSS

Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.

CWE-79Mar 21, 2025
CVSS6.3v3.1EPSS1.06%PoCs0SignalsSTIX

Account takeover

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

CWE-287Mar 3, 2025
CVSS8.1v3.1EPSS1.42%PoCs0SignalsSTIX

IDOR

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.

CWE-639Feb 5, 2025
CVSS3.5v3.1EPSS0.622%PoCs0SignalsSTIX

Improper Authorization

Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.

CWE-863Jan 29, 2025
CVSS8.1v3.1EPSS0.912%PoCs0SignalsSTIX

Sensitive Data Exposure

Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.

CWE-200CWE-276Nov 27, 2024
CVSS8.1v3.1EPSS1.13%PoCs0SignalsSTIX

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.

CWE-89Nov 18, 2024
CVSS8.3v3.1EPSS1.87%PoCs0SignalsSTIX

XML External Entity

Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.

CWE-611Nov 8, 2024
CVSS8.5v3.1EPSS1.62%PoCs0SignalsSTIX

Privilege Escalation

Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.

CWE-269Nov 8, 2024
CVSS8.8v3.1EPSS4.38%PoCs2SignalsSTIX

Agent Arbitrary File Deletion

Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.

CWE-269Nov 7, 2024
CVSS7.0v3.1EPSS0.351%PoCs0SignalsSTIX