Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. id: CVE-2017-11512 info...

CVE-2022-23779

CVE-2022-23779 CVE-2022-23779 is a security vulnerability in Zoho ManageEngine Desktop Central It is classified as an information disclosure issue CWE-200 where the software leaks internal server information to unauthorized users. Versions before 10.1.2137.8 are affected ::Medium severity...

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

ManageEngine - Remote Command Execution

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security...

Zoho ManageEngine ServiceDesk Plus - Authentication Bypass

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...

CVE-2026-14308

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService...

CVE-2026-14308 Insufficient Signature Validation

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService...

CVE-2026-14308

Zohocorp ManageEngine Malware Protection Plus versions prior to 1.0.64.12 are susceptible to a vulnerability caused by insufficient driver signature validation within the MEARWService component. This flaw may allow for unauthorized driver execution. The impact is categorized as having high availa...

PT-2026-111305

Name of the Vulnerable Software and Affected Versions ManageEngine Malware Protection Plus versions prior to 1.0.64.12 Description Insufficient driver signature validation occurs within the MEARWService component. This issue allows for the potential loading of unsigned or improperly signed driver...

CVE-2026-14308: Improper Input Validation

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService...

ManageEngine Products Vulnerability Scanner

A scanner for CVE-2022-47966 in supported ManageEngine products detects product build versions and SAML configuration, then reports whether instances are vulnerable, potentially vulnerable, unpatched, or likely not vulnerable...

ManageEngine ServiceDesk RCE (CVE-2021-44077)

Exploits CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus: unauthenticated zip upload to /RestAPI/ImportTechnicians achieves path traversal and RCE. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus ImportTechnicians RCE CVE-2021-44077.""" import io import zipfile fro...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

Zoho ManageEngine Desktop Central - Remote Code Execution

Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity:...

ManageEngine Applications Manager < Build 182100 Multiple Vulnerabilities

According to its self-reported version number, the instance of ManageEngine Applications Manager running on the remote host is build 182000 or below and is not one of the fixed builds 181104 to 181109, 182001 to 182009. It is, therefore, affected by multiple vulnerabilities: - ZohoCorp ManageEngi...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...