Unscored severity · published Feb 2, 2015
CVE-2015-0866
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Manageengine Supportcenter Plus · Zohocorp
through 7.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0866
www.securityfocus.com
http://www.securityfocus.com/archive/1/534564/100/0/threaded
Exploit
http://www.securityfocus.com/bid/72349
Patch
https://forums.manageengine.com/topic/security-update-for-supportcenter-plus
Exploit
https://www.htbridge.com/advisory/HTB23247
More from Manageengine Supportcenter Plus
9.8
CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
9.8
CVE-2023-23076
OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules
9.8
CVE-2022-36412
In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass
8.8
CVE-2022-40773
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation