Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how manageengine compares to other vendors in security performance

View Risk Score →

Software

manageengine applications manager
10
manageengine opmanager
5
manageengine servicedesk plus
5
manageengine desktop central
3
manageengine eventlog analyzer
3
manageengine firewall analyzer
3
manageengine it360
3
manageengine m365 manager plus
3
manageengine oputils
3
manageengine passwordmanager pro
3
manageengine adaudit plus
2
manageengine analytics plus
2
manageengine assetexplorer agent
2
manageengine opmanager msp
2
manageengine password manager pro
2
manageengine supportcenter plus
2
manageengine admanager plus
1
manageengine adselfservice plus
1
manageengine ddi central
1
manageengine device expert
1
manageengine manageengine pam360
1
manageengine manageengine password manager pro
1
manageengine netflow analyzer
1
manageengine password manager pro6.1
1
manageengine recoverymanager plus
1
manageengine servicedesk
1
manageengine unified endpoint management suite
1

ManageEngine DDI CentralAuthentication Bypass Leading to Account Takeover

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

First published (updated )
CVE-2026-12571

ManageEngine ADSelfService PlusAccount Takeover via Predictable SSO Ticket Generation

Risk 78
Severity
9
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

First published (updated )
CVE-2026-11374

ManageEngine ManageEngine PAM360SQL Injection

Risk 43
Severity
8.1
EPSS
0.02%
SQL Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

First published (updated )
CVE-2026-5785

ManageEngine Endpoint CentralIDOR

Risk 22
Severity
4.3
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.

First published (updated )
CVE-2024-9097

ManageEngine Analytics PlusManageEngine Analytics Plus getOAToken Exposed Dangerous Method Privilege Escalation Vulnerability

Risk 23

This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine Analytics Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-52323.

First published (updated )
Advisory
ZDI-24-1676

ManageEngine Analytics PlusZDI-24-1676: ManageEngine Analytics Plus getOAToken Exposed Dangerous Method Privilege Escalation Vulnerability

Risk 23

This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine Analytics Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-52323.

First published (updated )
ZDI-CAN-25135

ManageEngine Recovery Manager PlusManageEngine Recovery Manager Plus getEscapedValue Command Injection Remote Code Execution Vulnerability

Risk 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Recovery Manager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2023-48646.

First published (updated )
Advisory
ZDI-23-1719

ManageEngine Recovery Manager PlusZDI-23-1719: ManageEngine Recovery Manager Plus getEscapedValue Command Injection Remote Code Execution Vulnerability

Risk 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Recovery Manager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2023-48646.

First published (updated )
ZDI-CAN-21173

ManageEngine Applications ManagerManageEngine Applications Manager SingleSignOn Cross-Site Scripting Remote Code Execution Vulnerability

Risk 61

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Applications Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-38333.

First published (updated )
Advisory
ZDI-23-1715

ManageEngine Applications ManagerZDI-23-1715: ManageEngine Applications Manager SingleSignOn Cross-Site Scripting Remote Code Execution Vulnerability

Risk 61

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Applications Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-38333.

First published (updated )
ZDI-CAN-21226

ManageEngine ADManager PlusManageEngine ADManager Plus installServiceWithCredentials Command Injection Remote Code Execution Vulnerability

Risk 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2023-38743.

First published (updated )
Advisory
ZDI-23-1488

ManageEngine ADManager PlusZDI-23-1488: ManageEngine ADManager Plus installServiceWithCredentials Command Injection Remote Code Execution Vulnerability

Risk 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2023-38743.

First published (updated )
ZDI-CAN-21010

ManageEngine ADManager PlusManageEngine ADManager Plus download Directory Traversal Information Disclosure Vulnerability

Risk 31

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2023-39912.

First published (updated )
Advisory
ZDI-23-1401

ManageEngine ADManager PlusZDI-23-1401: ManageEngine ADManager Plus download Directory Traversal Information Disclosure Vulnerability

Risk 31

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2023-39912.

First published (updated )
ZDI-CAN-21184

ZohoCorp ManageEngine ADSelfService Plus(0Day) ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

Risk 63
Severity
6.8
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.

1 / 2
First published (updated )
CVE-2023-35719

ManageEngine ADSelfService PlusZDI-23-891: (0Day) ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

Risk 62
Severity
6.8
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

1 / 2
First published (updated )
ZDI-CAN-17009

ManageEngine ADSelfService Plus(0Day) ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

Risk 62
Severity
6.8
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

1 / 2
First published (updated )
Advisory
ZDI-23-891

ManageEngine ADSelfService PlusManageEngine ADSelfService Plus DomainUserSSPLogonAuth Improper Input Validation Denial-of-Service Vulnerability

Risk 43

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

First published (updated )
Advisory
ZDI-23-437

ManageEngine ADSelfService PlusZDI-23-437: ManageEngine ADSelfService Plus DomainUserSSPLogonAuth Improper Input Validation Denial-of-Service Vulnerability

Risk 43

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

First published (updated )
ZDI-CAN-20008

ManageEngine ADManager PlusManageEngine ADManager Plus ChangePasswordAction Command Injection Remote Code Execution Vulnerability

Risk 51

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability.

First published (updated )
Advisory
ZDI-23-438

ManageEngine ADManager PlusZDI-23-438: ManageEngine ADManager Plus ChangePasswordAction Command Injection Remote Code Execution Vulnerability

Risk 51

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability.

First published (updated )
ZDI-CAN-20033

ManageEngine ServiceDesk Plus MSPManageEngine ServiceDesk Plus MSP generateSQLReport Improper Input Validation Privilege Escalation Vulnerability

Risk 37

This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability.

First published (updated )
Advisory
ZDI-23-229

ManageEngine ServiceDesk Plus MSPZDI-23-229: ManageEngine ServiceDesk Plus MSP generateSQLReport Improper Input Validation Privilege Escalation Vulnerability

Risk 37

This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability.

First published (updated )
ZDI-CAN-19536

ManageEngine ServiceDesk PlusManageEngine ServiceDesk Plus ImageUploadServlet Improper Input Validation Denial-of-Service Vulnerability

Risk 31

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ManageEngine ServiceDesk Plus. Authentication is required to exploit this vulnerability.

First published (updated )
Advisory
ZDI-23-230

ManageEngine ServiceDesk PlusZDI-23-230: ManageEngine ServiceDesk Plus ImageUploadServlet Improper Input Validation Denial-of-Service Vulnerability

Risk 31

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ManageEngine ServiceDesk Plus. Authentication is required to exploit this vulnerability.

First published (updated )
ZDI-CAN-19537

ManageEngine OpManagerXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.

First published (updated )
CVE-2020-19554

ManageEngine Desktop CentralCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.

First published (updated )
CVE-2021-28960

ManageEngine OpManagerManageEngine OpManager OpmSkipFilter Directory Traversal Information Disclosure Vulnerability

Risk 44
Severity
7.5
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

1 / 2
First published (updated )
CVE-2020-13818

ManageEngine ADManager PlusXSS

Risk 38
Severity
6.1
XSS
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.

First published (updated )
CVE-2018-15608

ManageEngine Applications ManagerManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

Risk 86
Severity
9.8
SQL Injection
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.

First published (updated )
CVE-2016-9488

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203