Manageengine Supportcenter Plus (Zohocorp) - vulnerabilities (CVEs)

31 CVEs, 0 in the last 30 days, 74 known versions, newest CVE from 2025-05-22. Vendor: Zohocorp.

CVEs of Manageengine Supportcenter Plus

CVE-2025-3444 - CVSS 6.5 (medium), 2025-05-22: Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin…
CVE-2024-41150 - CVSS 6.3 (medium), 2024-08-23: An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter…
CVE-2024-38869 - CVSS 8.3 (high), 2024-08-23: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint…
CVE-2024-27314 - CVSS 2.4 (low), 2024-05-27: Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in…
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-35785 - CVSS 8.1 (high), 2023-08-28: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and…
CVE-2023-38331 - CVSS 5.4 (medium), 2023-07-28: Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.
CVE-2023-34197 - CVSS 5.4 (medium), 2023-07-07: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation…
CVE-2023-29443 - CVSS 4.9 (medium), 2023-04-26: Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow…
CVE-2023-26601 - CVSS 7.5 (high), 2023-03-06: Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow…
CVE-2023-26600 - CVSS 6.5 (medium), 2023-03-06: ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow…
CVE-2023-23076 - CVSS 9.8 (critical), 2023-02-01: OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
CVE-2022-40772 - CVSS 6.5 (medium), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report…
CVE-2022-40771 - CVSS 4.9 (medium), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
CVE-2022-40770 - CVSS 7.2 (high), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
CVE-2022-42903 - CVSS 3.3 (low), 2022-11-17: Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.
CVE-2022-40773 - CVSS 8.8 (high), 2022-11-12: Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain…
CVE-2022-36412 - CVSS 9.8 (critical), 2022-07-26: In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed…
CVE-2022-35403 - CVSS 7.5 (high), 2022-07-12: Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated…
CVE-2022-25373 - CVSS 5.4 (medium), 2022-04-05: Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
CVE-2021-43296 - CVSS 7.5 (high), 2021-11-30: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
CVE-2021-43295 - CVSS 6.1 (medium), 2021-11-30: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
CVE-2021-43294 - CVSS 6.1 (medium), 2021-11-30: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
CVE-2021-44077 - CVSS 9.8 (critical), 2021-11-29: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated…
CVE-2019-12133 - CVSS 7.8 (high), 2019-06-18: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its…
CVE-2018-16965 - CVSS 6.1 (medium), 2018-09-21: In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.
CVE-2015-5150 - CVSS 3.5 (low), 2015-06-30: Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web…
CVE-2015-5149 - CVSS 5.5 (medium), 2015-06-30: Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot…
CVE-2015-0866 - CVSS 4.3 (medium), 2015-02-02: Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary…
CVE-2014-100002 - CVSS 5 (medium), 2015-01-13: Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot…