Zoho ManageEngine ServiceDesk Plus 9.3 - (PurchaseRequest.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16940)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

CVE-2019-12196

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

CVE-2019-12538

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12538

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter...

Code injection

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12538

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12538

CVE-2019-12538 affects Zoho ManageEngine ServiceDesk Plus 9.3 with a Cross-Site Scripting (XSS) vulnerability in the SiteLookup.do search path. The root cause is improper input handling, enabling attacker-controlled script to run in the victim’s browser (payload example shows qc_siteID parameter ...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12541

Zoho ManageEngine ServiceDesk Plus 9.3 is affected by a cross-site scripting (XSS) vulnerability in the SolutionSearch.do searchText parameter. Root cause: inadequate validation/escaping in the SolutionSearch.do endpoint. Impact: potential execution of malicious client-side scripts in affected us...

CVE-2019-12542

CVE-2019-12542 affects Zoho ManageEngine ServiceDesk Plus 9.3. A cross-site scripting vulnerability exists via the SearchN.do parameter userConfigID, enabling injection of client-side code. The issue is documented across multiple sources (NVD, Red Hat security, CNVD, CVE listings) with the core d...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

CVE-2019-12543

CVE-2019-12543 affects Zoho ManageEngine ServiceDesk Plus 9.3. It is a Cross-Site Scripting (XSS) vulnerability via the PurchaseRequest.do parameter serviceRequestId (e.g., /PurchaseRequest.do?operation=getAssociatedPrsForSR&serviceRequestId=…). Root cause: insufficient input validation/sanitizat...