CVE-2018-20664

CRITICAL

ManageEngine ADSelfService Plus 5.x < 5701 - XML External Entity Injection via License Upload

Title source: llm

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.

Core 2

Core References

Release Notes, Vendor Advisory x_refsource_confirm

Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.0391

EPSS Percentile 88.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-611

Status published

Products (1)

zohocorp/manageengine_adselfservice_plus 5.7 4500 (50 CPE variants)

Published Jan 03, 2019

Tracked Since Feb 18, 2026