MA
Product
ManageEngine Applications Manager
63
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 24Medium 19Low 0
Watch
Add ManageEngine Applications Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86678 | 8.8 | Sep 23 | Broken Authentication vulnerability Affected: before 182100 |
| CVE-2026-86677 | 8.8 | Sep 23 | Broken Authentication vulnerability Affected: before 182100 |
| CVE-2025-9223 | 8.8 | Nov 11 | Command Injection Affected: before 178200 |
| CVE-2020-28679 | 8.8 | Jan 10 | A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.1; +34 more |
| CVE-2020-35765 | 8.8 | Feb 5 | doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter… Affected: before 14.9; 14.9; 14.9; 14.9; 14.9; 14.9 |
| CVE-2020-27733 | 8.8 | Jan 19 | Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2020-16267 | 8.8 | Oct 6 | Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module Affected: 14.7; 14.7; 14.7; 14.7; 14.7; 14.7; +1 more |
| CVE-2020-15927 | 8.8 | Oct 6 | Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module Affected: 14.7; 14.7; 14.7; 14.7; 14.7; 14.7; +1 more |
| CVE-2019-19475 | 8.8 | Jan 10 | An issue was discovered in ManageEngine Applications Manager 14 with Build 14360 Affected: 14.3 |
| CVE-2019-19650 | 8.8 | Dec 11 | Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function Affected: before 13.7 |
| CVE-2019-15105 | 8.8 | Aug 16 | An issue was discovered in Zoho ManageEngine Application Manager through 14.2 Affected: 12.0 through 14.2 |
| CVE-2019-15104 | 8.8 | Aug 16 | An issue was discovered in Zoho ManageEngine OpManager through 12.4x Affected: 12.0 through 14.0 |
| CVE-2017-11740 | 8.8 | May 23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm Affected: 13.1 |
| CVE-2016-9489 | 8.8 | Jul 13 | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e Affected: 12.0; 13.0 |
| CVE-2017-16542 | 8.8 | Nov 5 | Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request Affected: 13.0 |
| CVE-2026-86683 | 8.1 | Sep 23 | Broken Authentication Vulnerability Affected: before 182100 |
| CVE-2017-11738 | 8.1 | May 23 | In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection… Affected: 13.1 |
| CVE-2018-16364 | 8.1 | Sep 26 | A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share Affected: 13.7; 13.7; 13.7; 13.7; 13.7; 13.7; +4 more |
| CVE-2026-86681 | 7.6 | Sep 23 | Broken Access Control vulnerability Affected: before 182300 |
| CVE-2020-10816 | 7.5 | Oct 8 | Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet Affected: 14.7; 14.7; 14.7; 14.7; 14.7; 14.7; +4 more |
| CVE-2014-7863 | 7.5 | Feb 8 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and… Affected: through 11.9 |
| CVE-2022-23050 | 7.2 | May 24 | ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload… Affected: 15.0 before 15.5; 15.5; 15.5; 15.5 |
| CVE-2020-14008 | 7.2 | Sep 4 | Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution Affected: through 13.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-86679 | 7.1 | Sep 23 | Broken Access Control vulnerability Affected: before 182100 |
Showing 24