Manageengine Adselfservice Plus (Zohocorp) - vulnerabilities (CVEs)

56 CVEs, 0 in the last 30 days, 340 known versions, newest CVE from 2026-09-22. Vendor: Zohocorp.

CVEs of Manageengine Adselfservice Plus

CVE-2026-75791 - CVSS 8.6 (high), 2026-09-22: Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.
CVE-2026-74849 - CVSS 9.8 (critical), 2026-09-22: Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
CVE-2026-3183 - CVSS 7.1 (high), 2026-07-21: Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
CVE-2026-11374 - CVSS 9 (critical), 2026-06-23: In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be…
CVE-2026-2740 - CVSS 8.4 (high), 2026-05-21: Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to…
CVE-2026-1367 - CVSS 8.3 (high), 2026-02-23: Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.
CVE-2025-11250 - CVSS 9.1 (critical), 2026-01-13: Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.
CVE-2025-3833 - CVSS 8.1 (high), 2025-05-14: Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.
CVE-2025-1723 - CVSS 8.1 (high), 2025-03-03: Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in…
CVE-2024-27310 - CVSS 6.5 (medium), 2024-05-27: Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input.
CVE-2024-0252 - CVSS 8.8 (high), 2024-01-11: ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer…
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-35719 - CVSS 6.8 (medium), 2023-09-06: ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows…
CVE-2023-35854 - CVSS 9.8 (critical), 2023-06-20: Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity…
CVE-2023-28342 - CVSS 7.5 (high), 2023-04-05: Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
CVE-2022-36413 - CVSS 9.1 (critical), 2023-03-23: Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.
CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
CVE-2022-34829 - CVSS 7.5 (high), 2022-07-04: Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
CVE-2022-28987 - CVSS 5.3 (medium), 2022-05-20: Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
CVE-2022-29457 - CVSS 8.8 (high), 2022-04-18: Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during…
CVE-2022-28810 - CVSS 6.8 (medium), 2022-04-18: Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via…
CVE-2022-24681 - CVSS 6.1 (medium), 2022-04-07: Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password…
CVE-2021-20148 - CVSS 4.3 (medium), 2022-01-03: ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on…
CVE-2021-20147 - CVSS 5.3 (medium), 2022-01-03: ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an…
CVE-2021-37422 - CVSS 9.8 (critical), 2021-09-10: Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
CVE-2021-37423 - CVSS 9.8 (critical), 2021-09-10: Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
CVE-2021-40539 - CVSS 9.8 (critical), 2021-09-07: Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVE-2021-37417 - CVSS 9.8 (critical), 2021-08-30: Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
CVE-2021-37421 - CVSS 9.8 (critical), 2021-08-30: Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
CVE-2021-37416 - CVSS 6.1 (medium), 2021-08-30: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
CVE-2021-33055 - CVSS 9.8 (critical), 2021-08-30: Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
CVE-2021-33256 - CVSS 8.8 (high), 2021-08-09: A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user.…
CVE-2021-31874 - CVSS 5.9 (medium), 2021-07-02: Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database…
CVE-2021-28958 - CVSS 9.8 (critical), 2021-06-25: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVE-2021-27956 - CVSS 6.1 (medium), 2021-05-20: Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
CVE-2021-27214 - CVSS 6.1 (medium), 2021-02-19: A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote…
CVE-2018-5353 - CVSS 9.8 (critical), 2020-09-30: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via…
CVE-2020-24786 - CVSS 9.8 (critical), 2020-08-31: An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build…
CVE-2020-11552 - CVSS 9.8 (critical), 2020-08-11: An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges…
CVE-2020-11518 - CVSS 9.8 (critical), 2020-04-04: Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
CVE-2019-7162 - CVSS 9.1 (critical), 2019-12-31: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal…
CVE-2019-18781 - CVSS 6.1 (medium), 2019-12-18: An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a…
CVE-2019-18411 - CVSS 8.8 (high), 2019-11-06: Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be…
CVE-2019-12876 - CVSS 7.3 (high), 2019-07-17: Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from…
CVE-2019-12476 - CVSS 6.8 (medium), 2019-06-17: An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with…
CVE-2019-8346 - CVSS 6.1 (medium), 2019-05-24: In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated…
CVE-2019-11511 - CVSS 6.1 (medium), 2019-04-25: Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
CVE-2019-7161 - CVSS 7.5 (high), 2019-03-21: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the…
CVE-2019-3905 - CVSS 10 (critical), 2019-01-03: Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
CVE-2018-20664 - CVSS 9.8 (critical), 2019-01-03: Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
CVE-2018-20484 - CVSS 6.1 (medium), 2018-12-26: Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
CVE-2018-20485 - CVSS 6.1 (medium), 2018-12-26: Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
CVE-2014-3779 - CVSS 4.3 (medium), 2015-01-07: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script…
CVE-2011-5105 - CVSS 4.3 (medium), 2012-08-23: Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to…
CVE-2010-3274 - CVSS 4.3 (medium), 2011-02-17: Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5…
CVE-2010-3273 - CVSS 5 (medium), 2011-02-17: ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user…
CVE-2010-3272 - CVSS 4.3 (medium), 2011-02-17: accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote…