Vulnerabilidades de Zohocorp
CVEs publicadas que afetam produtos de Zohocorp: 86 registro(s), com severidade, exploração e correções.
Manageengine Exchange Reporter Plus 15ManageEngine OpManager 13Manageengine Adselfservice Plus 10Manageengine Endpoint Central 9Manageengine Applications Manager 9ManageEngine Firewall Analyzer 7Manageengine Pam360 7Manageengine Password Manager Pro 7DDI Central 5Manageengine Access Manager Plus 4Manageengine Servicedesk Plus 4Manageengine Admanager Plus 4ManageEngine DataSecurity Plus 3Manageengine Analytics Plus 3Manageengine Adaudit Plus 3Endpoint Central 3Manageengine M365 Manager Plus 2Manageengine Log360 2Manageengine Desktop Central 2ManageEngine RecoveryManager Plus 2ManageEngine NetFlow Analyzer 2ManageEngine Network Configuration Manager 2Manageengine Supportcenter Plus 2Manageengine Servicedesk Plus Msp 2ManageEngine OpUtils 1Zoho Mail wordpress plugin 1Analytics Plus 1ManageEngine M365 Security Plus 1Manageengine Ddi Central 1ManageEngine EventLog Analyzer 1Manageengine Vulnerability Manager Plus 1ManageEngine Malware Protection Plus 1Manageengine Remote Monitoring And Management Central 1Manageengine Remote Access Plus 1Manageengine Patch Manager Plus 1Manageengine Os Deployer 1Manageengine Endpoint Dlp Plus 1Manageengine Device Control Plus 1Manageengine Browser Security Plus 1Manageengine Application Control Plus 1
CVE-2026-28703
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
CVE-2026-28756
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
CVE-2026-28754
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
CVE-2026-1367
Alta · 8.3
CWE-89 23/02/2026
SQL Injection
Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.
CVE-2025-9226
Média · 4.6
CWE-79 30/01/2026
Stored XSS
Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.
CVE-2025-9435
Média · 5.5
CWE-22 13/01/2026
Path Traversal
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module
CVE-2025-11669
Alta · 8.1
CWE-862 13/01/2026
Broken Access Control
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.
CVE-2025-11250
Crítica · 9.1
CWE-290 13/01/2026
Authentication Bypass
Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.
CVE-2025-9787
Média · 6.1
CWE-79 18/12/2025
Stored XSS
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.
CVE-2025-11670
Média · 4.3
CWE-200 15/12/2025
NTLM Hash Exposure Vulnerability
Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.
This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
CVE-2025-9227
Média · 6.5
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.
CVE-2025-9223
Alta · 8.8
CWE-77 11/11/2025
Command Injection
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
CVE-2025-8324
Crítica · 9.8
CWE-89 11/11/2025
SQL Injection
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
CVE-2025-7633
Média · 6.1
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.
CVE-2025-7632
Média · 5.4
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
CVE-2025-7430
Média · 5.4
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.
CVE-2025-7429
Média · 5.4
CWE-79 11/11/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
CVE-2025-5347
Média · 5.4
CWE-79 30/10/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.
CVE-2025-5343
Média · 5.4
CWE-79 30/10/2025
Stored XSS
Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.
CVE-2025-5342
Média · 6.5
CWE-1333 30/10/2025
Denial of Service (DoS)
Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.
CVE-2025-11248
Média · 4.3
CWE-532 27/10/2025
Sensitive Information Logged
ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
CVE-2025-6239
Média · 6.5
CWE-200 21/10/2025
Information disclosure
Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.
CVE-2025-10020
Alta · 8.8
CWE-77 21/10/2025
Command Injection
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
CVE-2025-9428
Alta · 8.8
CWE-89 21/10/2025
SQL Injection
Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
CVE-2025-7473
Média · 5.3
CWE-91 21/10/2025
XML Injection
Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.