CVE-2015-0866

Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2015-02-02

Last modified

2024-08-06

Weaknesses

CWE-79

Affected products

• Manageengine Supportcenter Plus (Zohocorp)

References

• http://www.securityfocus.com/archive/1/534564/100/0/threaded
• http://www.securityfocus.com/bid/72349
• https://forums.manageengine.com/topic/security-update-for-supportcenter-plus
• https://www.htbridge.com/advisory/HTB23247