MA
IT Management
ManageEngine ADSelfService Plus
On CISA KEVExploited in the wildRansomware-linked
60
CVEs
6
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 14Medium 19Low 0
Watch
Add ManageEngine ADSelfService Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-47966 RansomwareIn wildKEV | 9.8 | Jan 18 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; +6 more |
| CVE-2022-35405 In wildKEV | 9.8 | Jul 19 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2021-40539 RansomwareIn wildKEV | 9.8 | Sep 7 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +4 more |
| CVE-2020-10189 In wildKEV | 9.8 | Mar 6 | Zoho ManageEngine Desktop Central File Upload Vulnerability Affected: All versions, or not specified |
| CVE-2022-28810 In wildKEV | 6.8 | Apr 18 | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +18 more |
| CVE-2019-8394 In wildKEV | 6.5 | Feb 17 | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability Affected: All versions, or not specified |
| CVE-2019-3905 | 10.0 | Jan 3 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2026-74849 | 9.8 | Sep 22 | Remote code execution vulnerability Affected: before 7001 |
| CVE-2023-35854 | 9.8 | Jun 20 | Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby… Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +9 more |
| CVE-2021-37422 | 9.8 | Sep 10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +8 more |
| CVE-2021-37423 | 9.8 | Sep 10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +8 more |
| CVE-2021-37421 | 9.8 | Aug 30 | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-37417 | 9.8 | Aug 30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-33055 | 9.8 | Aug 30 | Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +1 more |
| CVE-2021-28958 | 9.8 | Jun 25 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password Affected: 4.5; 4.5; 4.5; 4.5; 4.5; 4.5; +34 more |
| CVE-2018-5353 | 9.8 | Sep 30 | The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing Affected: before 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +13 more |
| CVE-2020-24786 | 9.8 | Aug 31 | An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,… Affected: through 5.7; 5.8; 5.8; 5.8; 5.8; 5.8; +13 more |
| CVE-2020-11552 | 9.8 | Aug 11 | An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a… Affected: through 5.8; 6.0; 6.0; 6.0; 6.0 |
| CVE-2020-11518 | 9.8 | Apr 4 | Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution Affected: through 5.7; 5.8; 5.8; 5.8; 5.8; 5.8; +11 more |
| CVE-2018-20664 | 9.8 | Jan 3 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license Affected: 5.7; 5.7; 5.7; 5.7; 5.7; 5.7; +34 more |
| CVE-2025-11250 | 9.1 | Jan 13 | Authentication Bypass Affected: before 6519 |
| CVE-2022-36413 | 9.1 | Mar 23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications Affected: before 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; +13 more |
| CVE-2019-7162 | 9.1 | Dec 31 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607 Affected: 5.6 |
| CVE-2026-11374 | 9.0 | Jun 23 | Account Takeover via Predictable SSO Ticket Generation Affected: before 6529 |
| CVE-2024-0252 | 8.8 | Jan 11 | ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component Affected: before 6.4; 6.4; 6.4 |
| CVE-2022-29457 | 8.8 | Apr 18 | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path… Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +17 more |
| CVE-2021-33256 | 8.8 | Aug 9 | A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user Affected: 6.1 |
| CVE-2019-18411 | 8.8 | Nov 6 | Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2026-75791 | 8.6 | Sep 22 | Authentication bypass vulnerability Affected: before 7001 |
| CVE-2026-2740 | 8.4 | May 21 | Remote Code Execution Affected: before 6525 |
| CVE-2026-1367 | 8.3 | Feb 23 | SQL Injection Affected: before 6523 |
| CVE-2025-3833 | 8.1 | May 14 | Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports Affected: before 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +9 more |
| CVE-2025-1723 | 8.1 | Mar 3 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling Affected: before 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +6 more |
| CVE-2023-28342 | 7.5 | Apr 5 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API Affected: 4.5; 4.5; 4.5; 4.5; 4.5; 4.5; +34 more |
| CVE-2022-34829 | 7.5 | Jul 4 | Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API Affected: before 6.2; 6.2; 6.2; 6.2 |
| CVE-2019-7161 | 7.5 | Mar 18 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704 Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2019-12876 | 7.3 | Jul 17 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to… Affected: 5.7 |
| CVE-2026-3183 | 7.1 | Jul 21 | Multi Factor Auth Bypass Affected: before 6524 |
| CVE-2023-35719 | 6.8 | Sep 6 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability Affected: 6.1 |
| CVE-2019-12476 | 6.8 | Jun 17 | An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a… Affected: 4.3.3 before 5.0.6 |
| CVE-2024-27310 | 6.5 | May 27 | Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input Affected: before 6.4; 6.4 |
| CVE-2022-24681 | 6.1 | Apr 7 | Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +17 more |
| CVE-2021-37416 | 6.1 | Aug 30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-27956 | 6.1 | May 20 | Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field Affected: before 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-27214 | 6.1 | Feb 19 | A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +7 more |
| CVE-2019-18781 | 6.1 | Dec 18 | An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent… Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2019-8346 | 6.1 | May 24 | In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript… Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2019-11511 | 6.1 | Apr 25 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API Affected: 5.7; 5.7; 5.7; 5.7; 5.7; 5.7; +34 more |
| CVE-2018-20485 | 6.1 | Dec 26 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature Affected: 4.5; 4.5; 4.5; 4.5; 4.5; 4.5; +34 more |
| CVE-2018-20484 | 6.1 | Dec 26 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation Affected: 5.7; 5.7; 5.7; 5.7; 5.7; 5.7; +34 more |