MA
IT Management
ManageEngine ADSelfService Plus
On CISA KEVExploited in the wildRansomware-linked
60
CVEs
6
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 14Medium 19Low 0
Watch
Add ManageEngine ADSelfService Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-47966 RansomwareIn wildKEV | 9.8 | Jan 18 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; +6 more |
| CVE-2022-35405 In wildKEV | 9.8 | Jul 19 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2021-40539 RansomwareIn wildKEV | 9.8 | Sep 7 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +4 more |
| CVE-2020-10189 In wildKEV | 9.8 | Mar 6 | Zoho ManageEngine Desktop Central File Upload Vulnerability Affected: All versions, or not specified |
| CVE-2019-3905 | 10.0 | Jan 3 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2026-74849 | 9.8 | Sep 22 | Remote code execution vulnerability Affected: before 7001 |
| CVE-2023-35854 | 9.8 | Jun 20 | Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby… Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +9 more |
| CVE-2021-37422 | 9.8 | Sep 10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +8 more |
| CVE-2021-37423 | 9.8 | Sep 10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +8 more |
| CVE-2021-37421 | 9.8 | Aug 30 | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-37417 | 9.8 | Aug 30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-33055 | 9.8 | Aug 30 | Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +1 more |
| CVE-2021-28958 | 9.8 | Jun 25 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password Affected: 4.5; 4.5; 4.5; 4.5; 4.5; 4.5; +34 more |
| CVE-2018-5353 | 9.8 | Sep 30 | The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing Affected: before 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +13 more |
| CVE-2020-24786 | 9.8 | Aug 31 | An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,… Affected: through 5.7; 5.8; 5.8; 5.8; 5.8; 5.8; +13 more |
| CVE-2020-11552 | 9.8 | Aug 11 | An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a… Affected: through 5.8; 6.0; 6.0; 6.0; 6.0 |
| CVE-2020-11518 | 9.8 | Apr 4 | Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution Affected: through 5.7; 5.8; 5.8; 5.8; 5.8; 5.8; +11 more |
| CVE-2018-20664 | 9.8 | Jan 3 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license Affected: 5.7; 5.7; 5.7; 5.7; 5.7; 5.7; +34 more |
| CVE-2025-11250 | 9.1 | Jan 13 | Authentication Bypass Affected: before 6519 |
| CVE-2022-36413 | 9.1 | Mar 23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications Affected: before 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; +13 more |
| CVE-2019-7162 | 9.1 | Dec 31 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607 Affected: 5.6 |
| CVE-2026-11374 | 9.0 | Jun 23 | Account Takeover via Predictable SSO Ticket Generation Affected: before 6529 |
Showing 22