CVE-2021-37416

MEDIUM NUCLEI

ManageEngine ADSelfService Plus <= 6103 - Reflected Cross-Site Scripting via Loadframe Page

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-37416 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

Nuclei Templates (1)

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting
MEDIUMVERIFIEDby edoardottt
Shodan: http.title:"ManageEngine" || http.title:"adselfservice plus" || http.title:"manageengine"
FOFA: title="manageengine" || title="adselfservice plus"

References (1)

Core 1
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://blog.stmcyber.com/vulns/cve-2021-37416/

Scores

CVSS v3 6.1
EPSS 0.0289
EPSS Percentile 85.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
zohocorp/manageengine_adselfservice_plus 6.1 (5 CPE variants)
zohocorp/manageengine_adselfservice_plus < 6.1
Published Aug 30, 2021
Tracked Since Feb 18, 2026