Login Request a demo
MA
Vendor
ManageEngine
26 products with CVEs on record
82
CVEs
0
On KEV
0
New 30D
Products
SP
ServiceDesk Plus
ManageEngine
8.8
12 CVEs0 on KEV0 new
AM
Applications Manager
ManageEngine
9.8
10 CVEs0 on KEV0 new
AP
ADAudit Plus
ManageEngine
8.3
9 CVEs0 on KEV0 new
FA
Firewall Analyzer
Manageengine
–
4 CVEs0 on KEV0 new
PM
Password Manager Pro
Manageengine
–
4 CVEs0 on KEV0 new
DC
Desktop Central
Manageengine
9.8
3 CVEs0 on KEV0 new
EA
Eventlog Analyzer
Manageengine
–
3 CVEs0 on KEV0 new
ER
Exchange Reporter Plus
ManageEngine
9.6
3 CVEs0 on KEV0 new
IT
It360
Manageengine
8.8
3 CVEs0 on KEV0 new
OP
OpManager
ManageEngine
6.1
3 CVEs0 on KEV0 new
OP
Oputils
Manageengine
–
3 CVEs0 on KEV0 new
SP
ServiceDesk Plus MSP
ManageEngine
8.1
3 CVEs0 on KEV0 new
SP
SupportCenter Plus
ManageEngine
8.1
3 CVEs0 on KEV0 new
AP
Admanager Plus
Manageengine
6.1
2 CVEs0 on KEV0 new
AP
ADSelfService Plus
ManageEngine
8.1
2 CVEs0 on KEV0 new
AS
Assetexplorer
Manageengine
8.8
2 CVEs0 on KEV0 new
NA
Netflow Analyzer
Manageengine
–
2 CVEs0 on KEV0 new
SE
Servicedesk
Manageengine
7.5
2 CVEs0 on KEV0 new
SU
Supportcenter
Manageengine
8.8
2 CVEs0 on KEV0 new
AE
Asset Explorer
ManageEngine
8.1
1 CVEs0 on KEV0 new
DE
Device Expert
Manageengine
–
1 CVEs0 on KEV0 new
EC
Endpoint Central
ManageEngine
4.3
1 CVEs0 on KEV0 new
OM
Opmanager Msp
Manageengine
–
1 CVEs0 on KEV0 new
PM
Password Manager Pro6.1
Manageengine
–
1 CVEs0 on KEV0 new
PP
Passwordmanager Pro
Manageengine
–
1 CVEs0 on KEV0 new
SP
SupportCentre Plus
ManageEngine
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-8309
AE
Asset Explorer
ManageEngine
8.1
0%
Aug 20User privilege escalation vulnerability
CVE-2025-27930
AM
Applications Manager
ManageEngine
5.4
0%
Jul 23Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.
CVE-2025-5966
ER
Exchange Reporter Plus
ManageEngine
8.1
1%
Jun 26Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.
CVE-2025-5366
ER
Exchange Reporter Plus
ManageEngine
8.1
1%
Jun 26Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.
CVE-2025-41444
AP
ADAudit Plus
ManageEngine
8.3
2%
Jun 9SQL Injection
CVE-2025-36528
AP
ADAudit Plus
ManageEngine
8.3
2%
Jun 9SQL Injection
CVE-2025-27709
AP
ADAudit Plus
ManageEngine
8.3
2%
Jun 9SQL Injection
CVE-2025-41437
OP
OpManager
ManageEngine
4.3
0%
Jun 9Reflected XSS
CVE-2025-3835
ER
Exchange Reporter Plus
ManageEngine
9.6
2%
Jun 9Remote Code Execution
CVE-2025-41407
AP
ADAudit Plus
ManageEngine
8.3
2%
May 23SQL Injection
CVE-2025-36527
AP
ADAudit Plus
ManageEngine
8.3
38%
May 23SQL Injection
CVE-2025-41403
AP
ADAudit Plus
ManageEngine
8.3
2%
May 22SQL Injection
CVE-2025-3836
AP
ADAudit Plus
ManageEngine
8.3
6%
May 22SQL Injection
CVE-2025-3444
SP
ServiceDesk Plus MSP
ManageEngine
6.5
2%
May 22Local File Inclusion
CVE-2025-3834
AP
ADAudit Plus
ManageEngine
8.1
2%
May 14SQL Injection
CVE-2025-3833
AP
ADSelfService Plus
ManageEngine
8.1
51%
May 14SQL Injection
CVE-2024-50053
SP
SupportCentre Plus
ManageEngine
5.4
1%
Mar 21Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.
CVE-2025-1723
AP
ADSelfService Plus
ManageEngine
8.1
1%
Mar 3Account takeover
CVE-2024-9097
EC
Endpoint Central
ManageEngine
4.3
1%
Feb 5ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.
CVE-2024-41140
AM
Applications Manager
ManageEngine
6.5
1%
Jan 29Improper Authorization
CVE-2024-52323
AP
Analytics Plus
ManageEngine
8.1
1%
Nov 27Sensitive Data Exposure
CVE-2020-19554
OP
Opmanager
Manageengine
6.1
1%
Sep 21Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload
CVE-2021-28960
DC
Desktop Central
Manageengine
9.8
2%
Sep 21Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations
CVE-2018-15608
AP
Admanager Plus
Manageengine
6.1
2%
Aug 28Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen
CVE-2016-9490
AM
Applications Manager
Manageengine
6.1
2%
Jun 5ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability
CVE-2016-9488
AM
Applications Manager
Manageengine
9.8
5%
Jun 5ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities
CVE-2017-11512
SE
Servicedesk
Manageengine
7.5
80%
Nov 8The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot…
CVE-2017-11511
SE
Servicedesk
Manageengine
7.5
4%
Nov 8The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file…
CVE-2015-8249
DC
Desktop Central
Manageengine
9.8
74%
Sep 28The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter
CVE-2014-5302
SP
Servicedesk Plus
Manageengine
8.8
11%
Aug 28Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote…
CVE-2014-5301
SP
Servicedesk Plus
Manageengine
8.8
78%
Aug 28Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4
CVE-2015-1480
SP
Servicedesk Plus
Manageengine
–
6%
Feb 4ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to…
CVE-2014-9373
NA
Netflow Analyzer
Manageengine
–
6%
Dec 16Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a
CVE-2014-9372
PM
Password Manager Pro
Manageengine
–
2%
Dec 16Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files…
CVE-2014-3996
DC
Desktop Central
Manageengine
–
38%
Dec 5SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build…
CVE-2014-8678
OP
Oputils
Manageengine
–
2%
Nov 25The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile."
CVE-2014-8499
PM
Password Manager Pro
Manageengine
–
36%
Nov 17Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow…
CVE-2014-5377
DE
Device Expert
Manageengine
–
57%
Sep 4ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request
CVE-2012-4891
FA
Firewall Analyzer
Manageengine
–
4%
Sep 10Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url…
CVE-2012-4889
FA
Firewall Analyzer
Manageengine
–
8%
Sep 10Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2)…
CVE-2012-2585
SP
Servicedesk Plus
Manageengine
–
1%
Aug 12Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body…
CVE-2012-1063
AM
Applications Manager
Manageengine
–
1%
Feb 14Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to…
CVE-2012-1062
AM
Applications Manager
Manageengine
–
1%
Feb 14Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1)…
CVE-2012-1049
AP
Admanager Plus
Manageengine
–
2%
Feb 13Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1)…
CVE-2010-4841
EA
Eventlog Analyzer
Manageengine
–
2%
Sep 27Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) HOST_ID, (2)…
CVE-2010-4840
EA
Eventlog Analyzer
Manageengine
–
2%
Sep 27Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service (SysEvttCol.exe process crash) or possibly…
CVE-2011-1510
SP
Servicedesk Plus
Manageengine
–
1%
Sep 20Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2011-1509
SP
Servicedesk Plus
Manageengine
–
1%
Sep 20The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier…
CVE-2011-2757
SP
Servicedesk Plus
Manageengine
–
39%
Jul 17Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a
CVE-2011-2756
SP
Servicedesk Plus
Manageengine
–
2%
Jul 17FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via…
CVE-2011-2755
SP
Servicedesk Plus
Manageengine
–
31%
Jul 17Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified…
CVE-2010-2049
AP
Adaudit Plus
Manageengine
–
3%
May 25Cross-site scripting (XSS) vulnerability in jsp/audit/reports/ExportReport.jsp in ManageEngine ADAudit Plus 4.0.0 build 4043 allows remote attackers to inject arbitrary web script…
CVE-2010-1044
OP
Oputils
Manageengine
–
1%
Mar 23SQL injection vulnerability in Login.do in ManageEngine OpUtils 5.0 allows remote attackers to execute arbitrary SQL commands via the isHttpPort parameter
CVE-2009-4387
PM
Password Manager Pro
Manageengine
–
1%
Dec 22The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for…
CVE-2009-3903
NA
Netflow Analyzer
Manageengine
–
2%
Nov 6Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or…
CVE-2008-2797
OP
Oputils
Manageengine
–
1%
Jun 20Cross-site scripting (XSS) vulnerability in MainLayout.do in ManageEngine OpUtils 5.0 allows remote attackers to inject arbitrary web script or HTML via the hostName parameter,…
CVE-2008-1775
FA
Firewall Analyzer
Manageengine
–
1%
Apr 14Cross-site scripting (XSS) vulnerability in mindex.do in ManageEngine Firewall Analyzer 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the displayName…
CVE-2008-1566
AM
Applications Manager
Manageengine
–
1%
Mar 31Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query…
CVE-2008-1538
EA
Eventlog Analyzer
Manageengine
–
1%
Mar 28Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText…
CVE-2008-1432
SP
Supportcenter Plus
Manageengine
–
1%
Mar 20Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the…