Login Request a demo
ZO
Vendor
Zoho
10 products with CVEs on record
73
CVEs
9
On KEV
0
New 30D
Products
MA
ManageEngine ADSelfService Plus
IT Management
10.0
60 CVEs6 on KEV0 new
DC
Desktop Central
Zoho
9.8
1 CVEs1 on KEV0 new
MS
ManageEngine ServiceDesk Plus (SDP)
Zoho
9.8
1 CVEs1 on KEV0 new
MS
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Zoho
9.8
1 CVEs1 on KEV0 new
SA
Salesiq
Zoho
8.8
4 CVEs0 on KEV0 new
ZC
Zoho Campaigns
Zoho
8.8
2 CVEs0 on KEV0 new
LM
Lead Magnet
Zoho
5.4
1 CVEs0 on KEV0 new
MR
Manageengine Remote Access Plus Server
Zoho
8.8
1 CVEs0 on KEV0 new
MA
Marketing Automation
Zoho
8.8
1 CVEs0 on KEV0 new
ZB
Zoho Books - Accounting App
Zoho
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-75791
MA
ManageEngine ADSelfService Plus
Zoho
8.6
2%
Sep 22Authentication bypass vulnerability
CVE-2026-74849
MA
ManageEngine ADSelfService Plus
Zoho
9.8
5%
Sep 22Remote code execution vulnerability
CVE-2026-3183
MA
ManageEngine ADSelfService Plus
Zoho
7.1
1%
Jul 21Multi Factor Auth Bypass
CVE-2026-11374
MA
ManageEngine ADSelfService Plus
Zoho
9.0
3%
Jun 23Account Takeover via Predictable SSO Ticket Generation
CVE-2026-2740
MA
ManageEngine ADSelfService Plus
Zoho
8.4
2%
May 21Remote Code Execution
CVE-2026-1367
MA
ManageEngine ADSelfService Plus
Zoho
8.3
9%
Feb 23SQL Injection
CVE-2025-11250
MA
ManageEngine ADSelfService Plus
Zoho
9.1
2%
Jan 13Authentication Bypass
CVE-2025-3833
MA
ManageEngine ADSelfService Plus
Zoho
8.1
51%
May 14Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports
CVE-2025-1723
MA
ManageEngine ADSelfService Plus
Zoho
8.1
1%
Mar 3Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling
CVE-2024-37225
MA
Marketing Automation
Zoho
8.8
0%
Jul 9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketing Automation: from…
CVE-2024-27310
MA
ManageEngine ADSelfService Plus
Zoho
6.5
2%
May 27Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input
CVE-2024-32442
ZC
Zoho Campaigns
Zoho
8.8
0%
Apr 15Cross-Site Request Forgery (CSRF) vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7
CVE-2024-32441
ZC
Zoho Campaigns
Zoho
8.8
0%
Apr 15Cross-Site Request Forgery (CSRF) vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7
CVE-2024-0252
MA
ManageEngine ADSelfService Plus
Zoho
8.8
8%
Jan 11ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component
CVE-2023-6105
MA
ManageEngine ADSelfService Plus
Zoho
5.5
1%
Nov 15An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed
CVE-2023-35719
MA
ManageEngine ADSelfService Plus
Zoho
6.8
25%
Sep 6ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability
CVE-2023-35854
MA
ManageEngine ADSelfService Plus
Zoho
9.8
6%
Jun 20Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby…
CVE-2023-28342
MA
ManageEngine ADSelfService Plus
Zoho
7.5
78%
Apr 5Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API
CVE-2022-36413
MA
ManageEngine ADSelfService Plus
Zoho
9.1
3%
Mar 23Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications
CVE-2022-47966
RansomwareIn wildKEV
MA
ManageEngine ADSelfService Plus
Zoho
9.8
100%
Jan 18Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
CVE-2022-35405
In wildKEV
MA
ManageEngine ADSelfService Plus
Zoho
9.8
100%
Jul 19Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
CVE-2022-34829
MA
ManageEngine ADSelfService Plus
Zoho
7.5
4%
Jul 4Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API
CVE-2022-28987
MA
ManageEngine ADSelfService Plus
Zoho
5.3
10%
May 20Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login
CVE-2022-29457
MA
ManageEngine ADSelfService Plus
Zoho
8.8
8%
Apr 18Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path…
CVE-2022-28810
In wildKEV
MA
ManageEngine ADSelfService Plus
Zoho
6.8
71%
Apr 18Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
CVE-2022-24681
MA
ManageEngine ADSelfService Plus
Zoho
6.1
4%
Apr 7Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen
CVE-2021-20148
MA
ManageEngine ADSelfService Plus
Zoho
4.3
1%
Jan 3ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name
CVE-2021-20147
MA
ManageEngine ADSelfService Plus
Zoho
5.3
7%
Jan 3ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI
CVE-2021-44515
In wildKEV
DC
Desktop Central
Zoho
9.8
100%
Dec 12Zoho Desktop Central Authentication Bypass Vulnerability
CVE-2021-44077
In wildKEV
MS
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Zoho
9.8
93%
Nov 29Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
CVE-2021-42956
MR
Manageengine Remote Access Plus Server
Zoho
8.8
1%
Nov 17Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability
CVE-2021-37422
MA
ManageEngine ADSelfService Plus
Zoho
9.8
3%
Sep 10Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases
CVE-2021-37423
MA
ManageEngine ADSelfService Plus
Zoho
9.8
3%
Sep 10Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover
CVE-2021-40539
RansomwareIn wildKEV
MA
ManageEngine ADSelfService Plus
Zoho
9.8
99%
Sep 7Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
CVE-2021-37415
In wildKEV
MS
ManageEngine ServiceDesk Plus (SDP)
Zoho
9.8
100%
Sep 1Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
CVE-2021-37421
MA
ManageEngine ADSelfService Plus
Zoho
9.8
2%
Aug 30Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass
CVE-2021-37417
MA
ManageEngine ADSelfService Plus
Zoho
9.8
5%
Aug 30Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation
CVE-2021-37416
MA
ManageEngine ADSelfService Plus
Zoho
6.1
3%
Aug 30Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page
CVE-2021-33055
MA
ManageEngine ADSelfService Plus
Zoho
9.8
18%
Aug 30Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions
CVE-2021-33256
MA
ManageEngine ADSelfService Plus
Zoho
8.8
79%
Aug 9A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user
CVE-2021-31874
MA
ManageEngine ADSelfService Plus
Zoho
5.9
4%
Jul 2Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application
CVE-2021-28958
MA
ManageEngine ADSelfService Plus
Zoho
9.8
73%
Jun 25Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password
CVE-2021-27956
MA
ManageEngine ADSelfService Plus
Zoho
6.1
2%
May 20Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field
CVE-2021-27214
MA
ManageEngine ADSelfService Plus
Zoho
6.1
2%
Feb 19A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to…
CVE-2018-5353
MA
ManageEngine ADSelfService Plus
Zoho
9.8
11%
Sep 30The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing
CVE-2020-24786
MA
ManageEngine ADSelfService Plus
Zoho
9.8
13%
Aug 31An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,…
CVE-2020-11552
MA
ManageEngine ADSelfService Plus
Zoho
9.8
7%
Aug 11An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a…
CVE-2020-11518
MA
ManageEngine ADSelfService Plus
Zoho
9.8
19%
Apr 4Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution
CVE-2020-10189
In wildKEV
MA
ManageEngine ADSelfService Plus
Zoho
9.8
100%
Mar 6Zoho ManageEngine Desktop Central File Upload Vulnerability
CVE-2019-7162
MA
ManageEngine ADSelfService Plus
Zoho
9.1
4%
Dec 31An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607
CVE-2019-18781
MA
ManageEngine ADSelfService Plus
Zoho
6.1
2%
Dec 18An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent…
CVE-2019-19306
LM
Lead Magnet
Zoho
5.4
1%
Nov 26The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName
CVE-2019-18411
MA
ManageEngine ADSelfService Plus
Zoho
8.8
2%
Nov 6Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page
CVE-2019-15645
SA
Salesiq
Zoho
8.8
1%
Aug 27The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF
CVE-2019-15644
SA
Salesiq
Zoho
6.1
1%
Aug 27The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS
CVE-2019-12876
MA
ManageEngine ADSelfService Plus
Zoho
7.3
5%
Jul 17Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to…
CVE-2019-5963
SA
Salesiq
Zoho
8.8
1%
Jul 5Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors
CVE-2019-5962
SA
Salesiq
Zoho
6.1
2%
Jul 5Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
CVE-2019-12476
MA
ManageEngine ADSelfService Plus
Zoho
6.8
2%
Jun 17An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a…
CVE-2019-8346
MA
ManageEngine ADSelfService Plus
Zoho
6.1
3%
May 24In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript…