EM
Product
Endpoint Manager
On CISA KEVExploited in the wild
119
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 10High 85Medium 24Low 0
Watch
Add Endpoint Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-62391 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62390 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62389 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62388 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62387 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62386 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62385 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62384 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-62383 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2025-11623 | 6.5 | Oct 13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2023-35083 | 6.5 | Oct 18 | Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions potentially leading to… Affected: before 2022; 2022; 2022; 2022; 2022 |
| CVE-2023-38344 | 6.5 | Sep 21 | An issue was discovered in Ivanti Endpoint Manager before 2022 SU4 Affected: before 2022; 2022; 2022; 2022; 2022 |
| CVE-2025-10573 | 6.1 | Dec 9 | Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator… Affected: before 2024; 2024; 2024; 2024; 2024; 2024; +1 more |
| CVE-2025-22465 | 6.1 | Apr 8 | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +3 more |
| CVE-2025-22464 | 6.1 | Apr 8 | An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +3 more |
| CVE-2020-13773 | 5.4 | Nov 16 | Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx,… Affected: through 2020.1.1 |
| CVE-2024-8320 | 5.3 | Sep 10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2020-13772 | 5.3 | Nov 16 | In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and… Affected: through 2020.1.1 |
| CVE-2025-22459 | 4.8 | Apr 8 | Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +3 more |