CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

Score

CVSS 3.1 4.8 Medium

Status

Modified - cve@mitre.org

Published

2021-02-03

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Manageengine Remote Access Plus (Zohocorp)

References

• https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageeng…
• https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html