VendorsZoho Corpmanageengine_applications_managerall versions
Vulnerabilities

Zoho Corp Zohocorp ManageEngine Applications Manager

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

56CVEs
CVE-2021-35512
An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.
Published 2021-10-21 · Modified
6.5EPSS 0.016
CVE-2025-6239
Information disclosure
Published 2025-10-21 · Analyzed
6.5EPSS 0.010
CVE-2025-27930
Stored XSS
Published 2025-07-23 · Analyzed
6.4EPSS 0.004
CVE-2023-28341
Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page.
Published 2023-04-11 · Modified
6.1EPSS 0.987
CVE-2023-29442
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
Published 2023-04-26 · Modified
6.1EPSS 0.094
CVE-2018-12996
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
Published 2018-06-29 · Modified
6.1EPSS 0.035
CVE-2017-11739
In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a "Utility Widget" that contains malicious JavaScript code, aka XSS.
Published 2019-05-23 · Modified
6.1EPSS 0.028
CVE-2023-38333
Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.
Published 2023-08-10 · Modified
6.1EPSS 0.023
CVE-2020-15521
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .
Published 2020-09-25 · Modified
6.1EPSS 0.017
CVE-2018-15169
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter.
Published 2018-08-08 · Modified
6.1EPSS 0.017
CVE-2025-9787
Stored XSS
Published 2025-12-18 · Analyzed
6.1EPSS 0.011
CVE-2021-31813
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.
Published 2021-07-01 · Modified
5.4EPSS 0.783
CVE-2019-19799
Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.
Published 2020-03-13 · Modified
5.3EPSS 0.064
CVE-2019-19800
Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.
Published 2020-02-06 · Modified
5.3EPSS 0.039
CVE-2017-11557
An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company's network environment via a userconfiguration.do?method=editUser request.
Published 2019-05-23 · Modified
5.3EPSS 0.037
CVE-2024-5678
SQL Injection
Published 2024-08-01 · Analyzed
4.7EPSS 0.026
← Prev2 / 2