ManageEngine Vulnerabilities and Affected Products

Products

ADAudit Plus35 vulnerabilities
adaudit_plus25 vulnerabilities
Applications Manager8 vulnerabilities
Exchange Reporter Plus8 vulnerabilities
ADSelfService Plus5 vulnerabilities
OpManager5 vulnerabilities
Endpoint Central4 vulnerabilities
ServiceDesk Plus MSP4 vulnerabilities
Desktop Central3 vulnerabilities
exchange_reporter_plus3 vulnerabilities
PAM3603 vulnerabilities
ServiceDesk Plus3 vulnerabilities
SupportCenter Plus3 vulnerabilities
ADManager Plus2 vulnerabilities
Analytics Plus2 vulnerabilities
Asset Explorer2 vulnerabilities
DDI Central2 vulnerabilities
servicedesk2 vulnerabilities
Access Manager Plus1 vulnerability
desktop_central1 vulnerability
OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition1 vulnerability
OpManager, Remote Monitoring and Management1 vulnerability
Password Manager Pro1 vulnerability
password_manager_pro1 vulnerability
Service Desk Plus1 vulnerability

ManageEngine vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-8309HIGH	User privilege escalation vulnerability There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940. CWE-269Aug 20, 2025	CVSS8.1v3.1	EPSS0.256%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-27930MEDIUM	Stored XSS Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor. CWE-79Jul 23, 2025	CVSS6.4v3.1	EPSS0.405%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-5966HIGH	Stored XSS Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. CWE-79Jun 26, 2025	CVSS8.1v3.1	EPSS1.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-5366HIGH	Stored XSS Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report. CWE-79Jun 26, 2025	CVSS8.1v3.1	EPSS1.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-41444HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module. CWE-89Jun 9, 2025	CVSS8.3v3.1	EPSS1.28%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-36528HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports. CWE-89Jun 9, 2025	CVSS8.3v3.1	EPSS1.28%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-27709HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports. CWE-89Jun 9, 2025	CVSS8.3v3.1	EPSS1.28%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-41437MEDIUM	Reflected XSS Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page. CWE-79Jun 9, 2025	CVSS4.3v3.1	EPSS0.215%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3835CRITICAL	Remote Code Execution Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module. CWE-434Jun 9, 2025	CVSS9.6v3.1	EPSS1.99%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-41407HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report. CWE-89May 23, 2025	CVSS8.3v3.1	EPSS1.33%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-36527HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports. CWE-89May 23, 2025	CVSS8.3v3.1	EPSS31%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-41403HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data. CWE-89May 22, 2025	CVSS8.3v3.1	EPSS1.59%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3836HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report. CWE-89May 22, 2025	CVSS8.3v3.1	EPSS5.36%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3444MEDIUM	Local File Inclusion Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded. CWE-434May 22, 2025	CVSS6.5v3.1	EPSS1.43%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3834HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report. CWE-89May 14, 2025	CVSS8.1v3.1	EPSS1.5%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3833HIGH	SQL Injection Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports. CWE-89May 14, 2025	CVSS8.1v3.1	EPSS38.4%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-50053MEDIUM	Stored XSS Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. CWE-79Mar 21, 2025	CVSS6.3v3.1	EPSS1.06%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-1723HIGH	Account takeover Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug. CWE-287Mar 3, 2025	CVSS8.1v3.1	EPSS1.42%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-9097LOW	IDOR ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. CWE-639Feb 5, 2025	CVSS3.5v3.1	EPSS0.622%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-41140HIGH	Improper Authorization Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. CWE-863Jan 29, 2025	CVSS8.1v3.1	EPSS0.912%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-52323HIGH	Sensitive Data Exposure Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account. CWE-200 CWE-276Nov 27, 2024	CVSS8.1v3.1	EPSS1.13%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-49574HIGH	SQL Injection Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module. CWE-89Nov 18, 2024	CVSS8.3v3.1	EPSS1.87%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-10839HIGH	XML External Entity Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. CWE-611Nov 8, 2024	CVSS8.5v3.1	EPSS1.62%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-24409HIGH	Privilege Escalation Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. CWE-269Nov 8, 2024	CVSS8.8v3.1	EPSS4.38%	PoCs2	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-10203HIGH	Agent Arbitrary File Deletion Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. CWE-269Nov 7, 2024	CVSS7.0v3.1	EPSS0.351%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX