Vulnerabilidades de Zohocorp
CVEs publicadas que afetam produtos de Zohocorp: 47 registro(s), com severidade, exploração e correções.
Manageengine Exchange Reporter Plus 15Manageengine Adselfservice Plus 7Manageengine Password Manager Pro 4Manageengine Endpoint Central 4Manageengine Servicedesk Plus 4Manageengine Pam360 4Manageengine Admanager Plus 4Endpoint Central 3Manageengine Applications Manager 3Manageengine Analytics Plus 3Manageengine Access Manager Plus 3Manageengine Servicedesk Plus Msp 2Manageengine Supportcenter Plus 2Manageengine Adaudit Plus 2Manageengine Desktop Central 2ManageEngine RecoveryManager Plus 2ManageEngine OpManager 2ManageEngine OpUtils 1Manageengine Log360 1ManageEngine Malware Protection Plus 1ManageEngine DataSecurity Plus 1Manageengine M365 Manager Plus 1ManageEngine NetFlow Analyzer 1Manageengine Patch Manager Plus 1Zoho Mail wordpress plugin 1Analytics Plus 1Manageengine Vulnerability Manager Plus 1Manageengine Remote Monitoring And Management Central 1Manageengine Remote Access Plus 1Manageengine Os Deployer 1Manageengine Endpoint Dlp Plus 1Manageengine Device Control Plus 1Manageengine Browser Security Plus 1Manageengine Application Control Plus 1Manageengine Key Manager Plus 1Manageengine Assetexplorer 1Manageengine Ad360 1
CVE-2026-14308
Média · 4.9
CWE-20 13/10/2026
Insufficient Signature Validation
Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.
CVE-2026-11374
Crítica · 9.0
CWE-287 23/06/2026
ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus e ADAudit Plus: tickets SSO previsíveis levando à tomada de conta (CVE-2026-11374)
No ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus e ADAudit Plus, os tickets SSO gerados para autenticar a sessão podiam ser previstos por um usuário não autenticado, levando à tomada de conta.
CVE-2026-8174
Média · 5.7
CWE-352 26/05/2026
Cross-site Request Forgery
Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).
This issue affects Zoho Mail wordpress plugin versions before 1.6.2.
CVE-2026-2740
Alta · 8.4
CWE-77 21/05/2026
Remote Code Execution
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
CVE-2026-3324
Alta · 8.2
CWE-288 16/04/2026
Authentication Bypass
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
CVE-2026-5785
Alta · 8.1
CWE-89 16/04/2026
SQL Injection
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
CVE-2026-27655
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
CVE-2026-4108
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
CVE-2026-4107
Média · 5.4
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
CVE-2026-3880
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
CVE-2026-3879
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.
CVE-2026-28703
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
CVE-2026-28756
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
CVE-2026-28754
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
CVE-2026-1367
Alta · 8.3
CWE-89 23/02/2026
SQL Injection
Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.
CVE-2025-9226
Média · 4.6
CWE-79 30/01/2026
Stored XSS
Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.
CVE-2025-9435
Média · 5.5
CWE-22 13/01/2026
Path Traversal
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module
CVE-2025-11669
Alta · 8.1
CWE-862 13/01/2026
Broken Access Control
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.
CVE-2025-11250
Crítica · 9.1
CWE-290 13/01/2026
Authentication Bypass
Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.
CVE-2025-9787
Média · 6.1
CWE-79 18/12/2025
Stored XSS
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.
CVE-2025-11670
Média · 4.3
CWE-200 15/12/2025
NTLM Hash Exposure Vulnerability
Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.
This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
CVE-2025-9227
Média · 6.5
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.
CVE-2025-9223
Alta · 8.8
CWE-77 11/11/2025
Command Injection
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
CVE-2025-8324
Crítica · 9.8
CWE-89 11/11/2025
SQL Injection
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
CVE-2025-7633
Média · 6.1
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.