Manageengine Opmanager (Zohocorp) - vulnerabilities (CVEs)

70 CVEs, 0 in the last 30 days, 890 known versions, newest CVE from 2026-09-23. Vendor: Zohocorp.

CVEs of Manageengine Opmanager

CVE-2026-19599 - CVSS 9.9 (critical), 2026-09-23: ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
CVE-2026-75825 - CVSS 8.8 (high), 2026-09-23: ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass…
CVE-2026-76978 - CVSS 8.8 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose…
CVE-2026-76979 - CVSS 7.7 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking…
CVE-2026-76980 - CVSS 7.4 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer…
CVE-2026-84787 - CVSS 8.1 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an…
CVE-2026-84789 - CVSS 7.1 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an…
CVE-2026-84791 - CVSS 7.1 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an…
CVE-2026-15358 - CVSS 7.5 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
CVE-2026-14913 - CVSS 8.8 (high), 2026-09-23: ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search…
CVE-2026-12370 - CVSS 7.6 (high), 2026-09-23: ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template…
CVE-2025-9226 - CVSS 4.6 (medium), 2026-01-30: Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the…
CVE-2025-9227 - CVSS 6.5 (medium), 2025-11-11: Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.
CVE-2024-5466 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in…
CVE-2024-6748 - CVSS 8.3 (high), 2024-07-29: Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL…
CVE-2023-47211 - CVSS 9.1 (critical), 2024-01-08: A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to…
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-31099 - CVSS 8.8 (high), 2023-05-04: Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
CVE-2022-43473 - CVSS 5.8 (medium), 2023-03-30: A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file…
CVE-2022-38772 - CVSS 8.8 (high), 2022-08-29: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and…
CVE-2022-37024 - CVSS 8.8 (high), 2022-08-10: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30…
CVE-2022-36923 - CVSS 7.5 (high), 2022-08-10: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27…
CVE-2022-35404 - CVSS 8.2 (high), 2022-07-18: ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
CVE-2022-29535 - CVSS 9.8 (critical), 2022-05-05: Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
CVE-2022-27908 - CVSS 8.8 (high), 2022-04-18: Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
CVE-2021-44514 - CVSS 9.8 (critical), 2021-12-09: OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
CVE-2021-41075 - CVSS 9.8 (critical), 2021-10-13: The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
CVE-2021-40493 - CVSS 9.8 (critical), 2021-10-13: Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the…
CVE-2021-41288 - CVSS 9.8 (critical), 2021-09-30: Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
CVE-2021-3287 - CVSS 9.8 (critical), 2021-04-22: Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
CVE-2021-20078 - CVSS 9.1 (critical), 2021-04-01: Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway…
CVE-2020-28653 - CVSS 9.8 (critical), 2021-02-03: Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM)…
CVE-2020-13818 - CVSS 7.5 (high), 2020-06-04: In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
CVE-2020-12116 - CVSS 7.5 (high), 2020-05-07: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the…
CVE-2020-11946 - CVSS 7.5 (high), 2020-04-20: Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
CVE-2020-11527 - CVSS 7.5 (high), 2020-04-04: In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
CVE-2020-10541 - CVSS 9.8 (critical), 2020-03-13: Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in…
CVE-2014-7863 - CVSS 7.5 (high), 2020-02-08: The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400,…
CVE-2019-17421 - CVSS 7.8 (high), 2019-11-21: Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to…
CVE-2019-17602 - CVSS 9.8 (critical), 2019-10-15: An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on…
CVE-2019-15106 - CVSS 9.8 (critical), 2019-08-16: An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the…
CVE-2019-12133 - CVSS 7.8 (high), 2019-06-18: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its…
CVE-2017-11560 - CVSS 5.4 (medium), 2019-05-23: An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This…
CVE-2017-11559 - CVSS 7.5 (high), 2019-05-23: An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and…
CVE-2017-11561 - CVSS 6.5 (medium), 2019-05-23: An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm"…
CVE-2018-20339 - CVSS 6.1 (medium), 2018-12-21: Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
CVE-2018-20338 - CVSS 9.8 (critical), 2018-12-21: Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
CVE-2018-20173 - CVSS 9.8 (critical), 2018-12-17: Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
CVE-2018-19921 - CVSS 6.1 (medium), 2018-12-06: Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
CVE-2018-18715 - CVSS 6.1 (medium), 2018-11-20: Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
CVE-2018-18716 - CVSS 6.1 (medium), 2018-11-20: Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
CVE-2018-19288 - CVSS 6.1 (medium), 2018-11-15: Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
CVE-2018-18980 - CVSS 7.5 (high), 2018-11-06: An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the…
CVE-2018-18949 - CVSS 9.8 (critical), 2018-11-05: Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
CVE-2018-18475 - CVSS 9.8 (critical), 2018-10-23: Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.
CVE-2018-18262 - CVSS 6.1 (medium), 2018-10-17: Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
CVE-2018-17283 - CVSS 7.5 (high), 2018-09-21: Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a…
CVE-2018-17243 - CVSS 9.8 (critical), 2018-09-20: Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
CVE-2018-12998 - CVSS 6.1 (medium), 2018-06-29: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build…
CVE-2018-12997 - CVSS 7.5 (high), 2018-06-29: Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build…
CVE-2015-9107 - CVSS 9.8 (critical), 2017-08-04: Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented…
CVE-2015-7766 - CVSS 9 (critical), 2015-10-09: PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the…
CVE-2015-7765 - CVSS 9 (critical), 2015-10-09: ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote…
CVE-2014-7864 - CVSS 7.5 (high), 2015-02-04: Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and…
CVE-2014-7866 - CVSS 7.5 (high), 2014-12-10: Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow…
CVE-2014-7868 - CVSS 7.5 (high), 2014-12-04: Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or…
CVE-2014-7867 - CVSS 7.5 (high), 2014-12-04: SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360…
CVE-2014-6036 - CVSS 6.4 (medium), 2014-12-04: Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4,…
CVE-2014-6035 - CVSS 7.5 (high), 2014-12-04: Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and…
CVE-2014-6034 - CVSS 5 (medium), 2014-12-04: Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through…