Manageengine Applications Manager
Monthly
Privilege escalation in ZohoCorp ManageEngine Applications Manager 182000 and earlier allows a holder of an authenticated low-privileged account to read an administrator's API key and then replay that key to carry out administrator-level actions over the network. Exploitation requires a valid low-privilege login (CVSS vector PR:L) on a vulnerable instance, but needs no user interaction and no special configuration, and successful abuse grants full high-integrity, high-confidentiality control of the application. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary limiting factor is the mandatory pre-existing low-privilege account, which is why this rates as a genuine high-priority flaw rather than a benign high-CVSS artifact.
SQL injection in ManageEngine Applications Manager (builds 182000 and below) allows an authenticated low-privileged user to run arbitrary SQL commands against the application's database, enabling escalation to administrator privileges and, from there, remote code execution on the underlying host. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is rated high priority because the only meaningful barrier is possession of any valid low-privileged account - no user interaction or special configuration is required, and once credentials exist the attack complexity is low. Exploitation status: no public exploit identified at time of analysis; the issue was reported by the vendor (Zohocorp), and no CISA KEV listing or public proof-of-concept code has been observed in the supplied intelligence.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
ManageEngine Applications Manager builds 182200 and below embed a static Google Cloud service-account private key inside the shipped installer, so anyone who downloads that installer artifact can extract the credential without authenticating to the product and then impersonate the service account directly against Google Cloud APIs. The vendor scores this CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) because the leaked key grants high confidentiality and integrity impact on associated cloud resources and the scope changes beyond the Applications Manager instance itself, with no authentication or user interaction required. Exploitation depends on the installer being obtainable and the referenced service account remaining active with meaningful IAM permissions; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the credential is static rather than runtime-dependent, which makes the exposure durable rather than conditional.
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in the NOC view of Zoho ManageEngine Applications Manager affects all builds up to and including 177400 and lets an authenticated user who can write or configure NOC view content plant a persistent script that runs in the browser of any user who subsequently opens that dashboard. Exploitation is not remote-unauthenticated: it requires the attacker to hold a session with privileges that allow content/configuration writes in the NOC view, and it depends on a second user rendering the poisoned view, so the practical impact is privilege-limited and victim-interaction dependent. No public exploit code has been identified at time of analysis, the EPSS score is low (1.10%, ~64th percentile), and the vendor has published a fix; only versions 177400 and below are affected.
Information disclosure in Zoho ManageEngine Applications Manager 17.6 (build 176800 and below) allows an authenticated, low-privileged user to read sensitive file and directory contents through the product's File/Directory monitor feature. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with high confidentiality impact but no integrity or availability effect, meaning it exposes data rather than enabling modification or denial of service. Exploitation requires a valid console session and access to the monitor feature; no public exploit code has been identified at time of analysis, no KEV listing exists, and EPSS is low at 0.96% (60th percentile), so risk is moderate and concentrated in environments that leave the management console broadly reachable with shared or loosely scoped accounts.
Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries'. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) . Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in ZohoCorp ManageEngine Applications Manager 182000 and earlier allows a holder of an authenticated low-privileged account to read an administrator's API key and then replay that key to carry out administrator-level actions over the network. Exploitation requires a valid low-privilege login (CVSS vector PR:L) on a vulnerable instance, but needs no user interaction and no special configuration, and successful abuse grants full high-integrity, high-confidentiality control of the application. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary limiting factor is the mandatory pre-existing low-privilege account, which is why this rates as a genuine high-priority flaw rather than a benign high-CVSS artifact.
SQL injection in ManageEngine Applications Manager (builds 182000 and below) allows an authenticated low-privileged user to run arbitrary SQL commands against the application's database, enabling escalation to administrator privileges and, from there, remote code execution on the underlying host. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is rated high priority because the only meaningful barrier is possession of any valid low-privileged account - no user interaction or special configuration is required, and once credentials exist the attack complexity is low. Exploitation status: no public exploit identified at time of analysis; the issue was reported by the vendor (Zohocorp), and no CISA KEV listing or public proof-of-concept code has been observed in the supplied intelligence.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
ManageEngine Applications Manager builds 182200 and below embed a static Google Cloud service-account private key inside the shipped installer, so anyone who downloads that installer artifact can extract the credential without authenticating to the product and then impersonate the service account directly against Google Cloud APIs. The vendor scores this CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) because the leaked key grants high confidentiality and integrity impact on associated cloud resources and the scope changes beyond the Applications Manager instance itself, with no authentication or user interaction required. Exploitation depends on the installer being obtainable and the referenced service account remaining active with meaningful IAM permissions; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the credential is static rather than runtime-dependent, which makes the exposure durable rather than conditional.
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in the NOC view of Zoho ManageEngine Applications Manager affects all builds up to and including 177400 and lets an authenticated user who can write or configure NOC view content plant a persistent script that runs in the browser of any user who subsequently opens that dashboard. Exploitation is not remote-unauthenticated: it requires the attacker to hold a session with privileges that allow content/configuration writes in the NOC view, and it depends on a second user rendering the poisoned view, so the practical impact is privilege-limited and victim-interaction dependent. No public exploit code has been identified at time of analysis, the EPSS score is low (1.10%, ~64th percentile), and the vendor has published a fix; only versions 177400 and below are affected.
Information disclosure in Zoho ManageEngine Applications Manager 17.6 (build 176800 and below) allows an authenticated, low-privileged user to read sensitive file and directory contents through the product's File/Directory monitor feature. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with high confidentiality impact but no integrity or availability effect, meaning it exposes data rather than enabling modification or denial of service. Exploitation requires a valid console session and access to the monitor feature; no public exploit code has been identified at time of analysis, no KEV listing exists, and EPSS is low at 0.96% (60th percentile), so risk is moderate and concentrated in environments that leave the management console broadly reachable with shared or loosely scoped accounts.
Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries'. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) . Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 12.3% and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.