CVE-2025-3444

<= 14.8

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File

6.5MEDIUM

CVE-2024-41150

<= 14.7

An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus M

6.3MEDIUM

CVE-2024-38869

<= 14.7

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.T

8.3HIGH

CVE-2024-27314

<= 14.6

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720

2.4LOW

CVE-2023-6105

< 14.3

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

5.5MEDIUM

CVE-2023-35785

< 14.3

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset

8.1HIGH

CVE-2023-38331

all versions

Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.

5.4MEDIUM

CVE-2023-34197

< 14.2

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a pri

5.4MEDIUM

CVE-2023-29443

< 14.0

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExpl

4.9MEDIUM

CVE-2023-26601

< 14.0

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Cent

7.5HIGH

CVE-2023-26600

< 11.0

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Expl

6.5MEDIUM

CVE-2023-23076

all versions

OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.

9.8CRITICAL

CVE-2022-47966

all versions

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of

9.8CRITICAL

CVE-2022-40772

< 11.0

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sens

6.5MEDIUM

CVE-2022-40771

< 11.0

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Informat

4.9MEDIUM

CVE-2022-40770

< 11.0

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploit

7.2HIGH

CVE-2022-42903

all versions

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.

3.3LOW

CVE-2022-40773

< 11.0

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. Th

8.8HIGH

CVE-2022-36412

all versions

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may

9.8CRITICAL

CVE-2022-35403

< 11.0

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affect

7.5HIGH

CVE-2022-25373

< 11.0

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.

5.4MEDIUM

CVE-2021-43296

all versions

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.

7.5HIGH

CVE-2021-43295

all versions

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.

6.1MEDIUM

CVE-2021-43294

all versions

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.

6.1MEDIUM

CVE-2021-44077

< 11.0

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulner

9.8CRITICAL

CVE-2019-12133

all versions

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\Manag

7.8HIGH

CVE-2018-16965

< 8.1

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.

6.1MEDIUM

CVE-2015-5150

all versions

Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users

CVE-2015-5149

all versions

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbit

CVE-2015-0866

<= 7.9

Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote at

CVE-2014-100002

<= 7.9

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary fil

CVE-2008-1432

all versions

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to