Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12538

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12538

CVE-2019-12538 affects Zoho ManageEngine ServiceDesk Plus 9.3 with a Cross-Site Scripting (XSS) vulnerability in the SiteLookup.do search path. The root cause is improper input handling, enabling attacker-controlled script to run in the victim’s browser (payload example shows qc_siteID parameter ...

CVE-2019-12541

Zoho ManageEngine ServiceDesk Plus 9.3 is affected by a cross-site scripting (XSS) vulnerability in the SolutionSearch.do searchText parameter. Root cause: inadequate validation/escaping in the SolutionSearch.do endpoint. Impact: potential execution of malicious client-side scripts in affected us...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12542

CVE-2019-12542 affects Zoho ManageEngine ServiceDesk Plus 9.3. A cross-site scripting vulnerability exists via the SearchN.do parameter userConfigID, enabling injection of client-side code. The issue is documented across multiple sources (NVD, Red Hat security, CNVD, CVE listings) with the core d...

CVE-2019-12542

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter...

CVE-2019-12543

CVE-2019-12543 affects Zoho ManageEngine ServiceDesk Plus 9.3. It is a Cross-Site Scripting (XSS) vulnerability via the PurchaseRequest.do parameter serviceRequestId (e.g., /PurchaseRequest.do?operation=getAssociatedPrsForSR&serviceRequestId=…). Root cause: insufficient input validation/sanitizat...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

Zoho ManageEngine ServiceDesk Plus 9.3 - (SearchN.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

Zoho ManageEngine ServiceDesk Plus 9.3 - (SolutionSearch.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SolutionSearch.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

CVE-2019-12541: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

PT-2019-12846

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in Zoho ManageEngine ServiceDesk Plus. There is a cross-site scripting XSS issue via the userConfigID parameter in the "SearchN.do" endpoint. Recommendations Fo...

PT-2019-12845

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a possibility of XSS via the searchText parameter in the "SolutionSearch.do" endpoint. Recommendations For Zoho ManageEngine...

PT-2019-12842

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered that allows for XSS via the SiteLookup.do search field. Recommendations For Zoho ManageEngine ServiceDesk Plus version 9.3, consider restricting access to the...

PT-2019-12847

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a cross-site scripting XSS vulnerability via the serviceRequestId parameter in the "PurchaseRequest.do" service. Recommendations...

CVE-2019-12543: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

Zoho ManageEngine ServiceDesk Plus 9.3 - (SiteLookup.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SiteLookup.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

CVE-2019-12538: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...