Zohocorp vulnerabilities
Published CVEs affecting Zohocorp products: 86 record(s), with severity, exploitation and fixes.
Manageengine Exchange Reporter Plus 15ManageEngine OpManager 13Manageengine Adselfservice Plus 10Manageengine Endpoint Central 9Manageengine Applications Manager 9ManageEngine Firewall Analyzer 7Manageengine Pam360 7Manageengine Password Manager Pro 7DDI Central 5Manageengine Access Manager Plus 4Manageengine Servicedesk Plus 4Manageengine Admanager Plus 4ManageEngine DataSecurity Plus 3Manageengine Analytics Plus 3Manageengine Adaudit Plus 3Endpoint Central 3Manageengine M365 Manager Plus 2Manageengine Log360 2Manageengine Desktop Central 2ManageEngine RecoveryManager Plus 2ManageEngine NetFlow Analyzer 2ManageEngine Network Configuration Manager 2Manageengine Supportcenter Plus 2Manageengine Servicedesk Plus Msp 2ManageEngine OpUtils 1Zoho Mail wordpress plugin 1Analytics Plus 1ManageEngine M365 Security Plus 1Manageengine Ddi Central 1ManageEngine EventLog Analyzer 1Manageengine Vulnerability Manager Plus 1ManageEngine Malware Protection Plus 1Manageengine Remote Monitoring And Management Central 1Manageengine Remote Access Plus 1Manageengine Patch Manager Plus 1Manageengine Os Deployer 1Manageengine Endpoint Dlp Plus 1Manageengine Device Control Plus 1Manageengine Browser Security Plus 1Manageengine Application Control Plus 1
CVE-2026-28703
Medium · 4.8
CWE-79 Apr 3, 2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
CVE-2026-28756
Medium · 4.8
CWE-79 Apr 3, 2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
CVE-2026-28754
Medium · 4.8
CWE-79 Apr 3, 2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
CVE-2026-1367
High · 8.3
CWE-89 Feb 23, 2026
SQL Injection
Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.
CVE-2025-9226
Medium · 4.6
CWE-79 Jan 30, 2026
Stored XSS
Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.
CVE-2025-9435
Medium · 5.5
CWE-22 Jan 13, 2026
Path Traversal
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module
CVE-2025-11669
High · 8.1
CWE-862 Jan 13, 2026
Broken Access Control
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.
CVE-2025-11250
Critical · 9.1
CWE-290 Jan 13, 2026
Authentication Bypass
Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.
CVE-2025-9787
Medium · 6.1
CWE-79 Dec 18, 2025
Stored XSS
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.
CVE-2025-11670
Medium · 4.3
CWE-200 Dec 15, 2025
NTLM Hash Exposure Vulnerability
Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.
This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
CVE-2025-9227
Medium · 6.5
CWE-79 Nov 11, 2025
Stored XSS
Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.
CVE-2025-9223
High · 8.8
CWE-77 Nov 11, 2025
Command Injection
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
CVE-2025-8324
Critical · 9.8
CWE-89 Nov 11, 2025
SQL Injection
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
CVE-2025-7633
Medium · 6.1
CWE-79 Nov 11, 2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.
CVE-2025-7632
Medium · 5.4
CWE-79 Nov 11, 2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
CVE-2025-7430
Medium · 5.4
CWE-79 Nov 11, 2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.
CVE-2025-7429
Medium · 5.4
CWE-79 Nov 11, 2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
CVE-2025-5347
Medium · 5.4
CWE-79 Oct 30, 2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.
CVE-2025-5343
Medium · 5.4
CWE-79 Oct 30, 2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.
CVE-2025-5342
Medium · 6.5
CWE-1333 Oct 30, 2025
Denial of Service (DoS)
Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.
CVE-2025-11248
Medium · 4.3
CWE-532 Oct 27, 2025
Sensitive Information Logged
ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
CVE-2025-6239
Medium · 6.5
CWE-200 Oct 21, 2025
Information disclosure
Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.
CVE-2025-10020
High · 8.8
CWE-77 Oct 21, 2025
Command Injection
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
CVE-2025-9428
High · 8.8
CWE-89 Oct 21, 2025
SQL Injection
Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
CVE-2025-7473
Medium · 5.3
CWE-91 Oct 21, 2025
XML Injection
Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.