CVE-2022-35405

CVE-2022-35405 My blog post Nuclei template Other article ManageEngine PAM360 and Password Manager Pro unauthenticated remote code execution vulnerability PoC Access Manager Plus authenticated only : Product Name| Affected Versions| Default port ---|---|--- PAM360| 5.5 5500 and below| 8282 Passwo...

pmp-exploit

pmp-exploit This exploit takes advantage of the Privilege Escalation vulnerability found within Password Manager Pro to elevate a regular user to SuperAdmin and then download the passwords and files stored within the application. Systems Affected Product : ManageEngine Password Manager Pro Compan...

CVE-2023-4861-PoC

CVE-2023-4861 PoC This repository contains a Python proof of concept for CVE-2023-4861 , an authenticated remote code execution issue in the WordPress plugin File Manager Pro - Filester. Vulnerability Summary CVE: CVE-2023-4861 Product: File Manager Pro - Filester filester Vulnerable versions:...

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

WordPress File Manager Pro plugin < 2.1.3 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin File Manager Pro versions 2.1.3...

CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-86609

The Download Manager WordPress plugin (versions before 7.5.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape data submitted via the email-locked download subscription form before it is outputted on an admin page. This flaw allows unauthe...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081

Multiple WordPress plugins—File Manager (before 8.0.5), FileOrganizer (before 1.2.1), and File Manager Pro (before 2.1.3)—are vulnerable to a DOM-based XSS due to improper validation of postMessage origins. The flaw exists in the bundled file-manager library (versions below 2.1.70), where the app...

EUVD-2026-87534

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081: Improper Neutralization of Input During Web Page Generation

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

PT-2026-99245

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 FileOrganizer WordPress plugin versions prior to 1.2.1 File Manager Pro WordPress plugin versions prior to 2.1.3 Description These plugins fail to correctly validate the origin of window...

ManageEngine Password Manager Pro < Build 13235 SQLi (CVE-2026-14828)

According to its self-reported build number, the ManageEngine Password Manager Pro application running on the remote host is prior to build 13235. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious...

CVE-2026-14828

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

CVE-2026-14828

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

EUVD-2026-69888

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

CVE-2026-14828

Zohocorp ManageEngine products—Password Manager Pro (before 13235), PAM360 (before 8561), and Access Manager Plus (before 4405)—are vulnerable to an authenticated SQL Injection flaw. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploit...