ManageEngine ADSelfService Plus vulnerabilities

Latest ManageEngine ADSelfService Plus CVEs

Newest publication first

1. CVE-2025-3833 SQL Injection

   Published 2025-05-14

   High·CVSS 8.1 EPSS 50.5%

   Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.

2. CVE-2025-1723 Account takeover

   Published 2025-03-03

   High·CVSS 8.1 EPSS 1.5%

   Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

3. CVE-2024-27310 DOS Vulnerability

   Published 2024-05-27

   Medium·CVSS 6.5 EPSS 2.3%

   Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input.

4. CVE-2024-0252 Remote code execution

   Published 2024-01-11

   High·CVSS 8.8 EPSS 7.8%

   ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

5. CVE-2023-35719 ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

   Published 2023-09-06

   Medium·CVSS 6.8 EPSS 24.6%

   ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentic...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.