ManageEngine admanager plus vulnerabilities

Latest ManageEngine admanager plus CVEs

Newest publication first

1. CVE-2024-24409 Privilege Escalation

   Published 2024-11-08

   High·CVSS 8.8 EPSS 6.2%

   Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.

2. CVE-2024-48878 SQL Injection

   Published 2024-11-04

   High·CVSS 8.8 EPSS 3.2%

   Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.

3. CVE-2018-15608 Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.

   Published 2018-08-28

   Medium·CVSS 6.1 EPSS 2.5% Public exploit

   Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.

4. CVE-2012-1049 Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/...

   Published 2012-02-13

   Medium·CVSS 4.3 EPSS 1.6%

   Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.