CVE-2025-3444

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - 0fc0942c-577d-436f-ae8e-945763c79b02

Published

2025-05-22

Last modified

2025-05-22

Weaknesses

CWE-434

Affected products

• Servicedesk Plus Msp (Manageengine)
• Supportcenter Plus (Manageengine)
• Manageengine Servicedesk Plus Msp (Zohocorp)
• Manageengine Supportcenter Plus (Zohocorp)

References

• https://www.manageengine.com/products/service-desk-msp/cve-2025-3444.html