Manageengine Admanager Plus (Zohocorp) - vulnerabilities (CVEs)

53 CVEs, 0 in the last 30 days, 151 known versions, newest CVE from 2026-01-13. Vendor: Zohocorp.

CVEs of Manageengine Admanager Plus

CVE-2025-9435 - CVSS 5.5 (medium), 2026-01-13: Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module
CVE-2025-11670 - CVSS 6.4 (medium), 2025-12-15: Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who…
CVE-2025-10020 - CVSS 8.8 (high), 2025-10-21: Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
CVE-2024-24409 - CVSS 8.8 (high), 2024-11-08: Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.
CVE-2024-48878 - CVSS 8.8 (high), 2024-11-04: Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-41904 - CVSS 5.4 (medium), 2023-09-27: Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.
CVE-2023-38743 - CVSS 7.2 (high), 2023-09-11: Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.
CVE-2023-39912 - CVSS 4.9 (medium), 2023-08-31: Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.
CVE-2023-35785 - CVSS 8.1 (high), 2023-08-28: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and…
CVE-2023-31492 - CVSS 6.5 (medium), 2023-08-17: Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the…
CVE-2023-38332 - CVSS 6.5 (medium), 2023-08-04: Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure.
CVE-2023-35786 - CVSS 4.9 (medium), 2023-07-05: Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
CVE-2023-29084 - CVSS 7.2 (high), 2023-04-13: Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
CVE-2022-42904 - CVSS 7.2 (high), 2022-11-18: Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.
CVE-2022-29457 - CVSS 8.8 (high), 2022-04-18: Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during…
CVE-2021-42002 - CVSS 9.8 (critical), 2021-11-11: Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
CVE-2021-20130 - CVSS 8.8 (high), 2021-10-13: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the…
CVE-2021-20131 - CVSS 8.8 (high), 2021-10-13: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the…
CVE-2021-38298 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
CVE-2021-37926 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37930 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37918 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37921 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37924 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37929 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37762 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.
CVE-2021-37920 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37923 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37928 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37931 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37919 - CVSS 9.8 (critical), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVE-2021-37922 - CVSS 5.3 (medium), 2021-10-07: Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another.
CVE-2021-37761 - CVSS 9.8 (critical), 2021-09-27: Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution.
CVE-2021-37539 - CVSS 9.8 (critical), 2021-09-27: Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.
CVE-2021-37927 - CVSS 9.8 (critical), 2021-09-22: Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.
CVE-2021-37925 - CVSS 9.8 (critical), 2021-09-22: Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.
CVE-2021-37419 - CVSS 7.5 (high), 2021-09-21: Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
CVE-2021-37741 - CVSS 8.8 (high), 2021-09-21: ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
CVE-2021-37424 - CVSS 9.8 (critical), 2021-09-21: ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
CVE-2021-37420 - CVSS 6.5 (medium), 2021-09-21: Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
CVE-2021-36772 - CVSS 6.1 (medium), 2021-07-17: Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.
CVE-2021-36771 - CVSS 6.1 (medium), 2021-07-17: Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
CVE-2021-33911 - CVSS 9.8 (critical), 2021-07-17: Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.
CVE-2020-35594 - CVSS 6.1 (medium), 2021-03-05: Zoho ManageEngine ADManager Plus before 7066 allows XSS.
CVE-2020-24786 - CVSS 9.8 (critical), 2020-08-31: An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build…
CVE-2019-12876 - CVSS 7.3 (high), 2019-07-17: Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from…
CVE-2018-19374 - CVSS 7 (high), 2019-04-30: Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin…
CVE-2018-15740 - CVSS 6.1 (medium), 2018-08-28: Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
CVE-2017-17552 - CVSS 8.8 (high), 2018-02-07: /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a…
CVE-2015-1026 - CVSS 4.3 (medium), 2015-03-11: Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web…
CVE-2010-5050 - CVSS 4.3 (medium), 2011-11-23: Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary…