CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus 4.3.3 버전 - Windows 10에서 인증 우회를 위한 PoC입니다. 모든 Windows 버전에 영향 PoC 동영상 재현 단계 1. 엔터프라이즈 네트워크에서 연결 해제 2. 자신의 핫스팟에 연결 3. 비밀번호 재설정 클릭; thick 클라이언트 브라우저가 인트라넷에 호스팅된 비밀번호 재설정 웹 애플리케이션에 연결할 수 없으면 404 오류가 발생해야 함 4. 이 사이트 검색 클릭 - 새 인터넷 익스플로러 창이 열림 5...

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539：ADSelfService Plus RCE脆弱性 一：脆弱性の説明 ZOHO ManageEngine ADSelfService Plusは、ZOHO社のActive Directoryおよびクラウドアプリケーション向けの統合型セルフサービスパスワード管理およびシングルサインオンソリューションです。 CVE-2021-40539 Zoho ManageEngine ADSelfService Plus 6113 およびそれ以前のバージョンには、REST...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE 취약점 1: 취약점 설명 ZOHO ManageEngine ADSelfService Plus는 주하오ZOHO 사의 Active Directory 및 클라우드 애플리케이션을 위한 통합 셀프 서비스 비밀번호 관리 및 싱글 사인온SSO 솔루션입니다. CVE-2021-40539 Zoho ManageEngine ADSelfService Plus 6113 및 이전 버전에는 REST API 인증 우회 취약점이 존재하며, 원격 공격자는 이 취약점을...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 ADSelfService Plus RCE 취약점 탐지 도구 2차 개발 설명 ZOHO ManageEngine ADSelfService Plus는 ZOHO사의 Active Directory 및 클라우드 애플리케이션을 위한 통합 셀프 서비스 비밀번호 관리 및 싱글 사인온 솔루션입니다. 네트워크 매핑 fofa:"ADSelfService" app="ZOHO-ManageEngine-ADSelfService" header="JSESSIONIDADSSP"...

ManageEngine AD360 Detection Tool

A proof of concept detection tool for ManageEngine AD360 products affected by CVE-2026-11374. The Python utility safely checks whether an ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, or ADAudit Plus deployment is AD360-integrated and therefore meets the exploit precondition for th...

CVE-2026-3183

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-3183 Multi Factor Auth Bypass

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

ManageEngine ADSelfService Plus < Build 6529 Account Takeover (CVE-2026-11374)

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6529. It is, therefore, affected by an account takeover vulnerability: - The SSO tickets generated to authenticate a session could be predicted by an unauthenticate...

CVE-2026-11374

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover...

CVE-2026-11374 Account Takeover via Predictable SSO Ticket Generation

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover...

PT-2026-51487

Name of the Vulnerable Software and Affected Versions ADSelfService Plus versions prior to 6529 RecoveryManager Plus versions prior to 6321 M365 Manager Plus versions prior to 4817 ADAudit Plus versions prior to 8703 Description In ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and...

CVE-2026-2740

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

ManageEngine ADSelfService Plus < Build 6525 Authenticated RCE

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6525. It is, therefore, affected by an authenticated remote code execution vulnerability. This vulnerability stems from improper access controls to the service used...

CVE-2026-2740

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

CVE-2026-2740

This CVE affects Zohocorp ManageEngine ADSelfService Plus (before 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313). Root cause: a bug in a third‑party dependency leading to Authenticated Remote Code Execution on agent machines. Affected products expose a high impact ...

EUVD-2026-31283

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

PT-2026-42464

Name of the Vulnerable Software and Affected Versions ADSelfService Plus versions prior to 6525 DataSecurity Plus versions prior to 6264 RecoveryManager Plus versions prior to 6313 Description Authenticated remote code execution can occur in agent machines due to a bug in a third-party dependency...

ZOHO多款产品 命令注入漏洞

ZOHO ManageEngine DataSecurity Plus is a product of the American company ZOHO. ZOHO ManageEngine DataSecurity Plus is a sensitive data management solution. ZOHO ManageEngine ADSelfService Plus is an integrated self-service password management and single-sign-on solution for Active Directory and...