CVE-2018-20485

MEDIUM

Zohocorp Manageengine Adselfservice Plus - XSS

Title source: rule

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

exploitdb WORKING POC

by Ibrahim Raafat · textwebappsphp

Core 2

Core References

Release Notes, Vendor Advisory x_refsource_misc

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 6.1

EPSS 0.0170

EPSS Percentile 82.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Status published

Products (4)

zohocorp/manageengine_adselfservice_plus 4.5 4510 (17 CPE variants)

zohocorp/manageengine_adselfservice_plus 5.0 5000 (12 CPE variants)

zohocorp/manageengine_adselfservice_plus 5.1 5100 (16 CPE variants)

zohocorp/manageengine_adselfservice_plus 5.2 5200 (5 CPE variants)

Published Dec 26, 2018

Tracked Since Feb 18, 2026