Skip to content

Product

ManageEngine opmanager vulnerabilities

6 published CVES affecting ManageEngine opmanager, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
0
High
2
Medium
4
Low
0
Unscored
0
CISA KEV
0

Latest ManageEngine opmanager CVEs

Newest publication first

  1. CVE-2025-41437 Reflected XSS

    Published
    MediumCVSS 4.3 EPSS 0.26%

    Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.

  2. CVE-2024-6748 SQL Injection

    Published
    HighCVSS 8.3 EPSS 23.8%

    Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.

  3. CVE-2023-47211 A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send...

    Published
    HighCVSS 8.6 EPSS 47.0%

    A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.

  4. CVE-2022-43473 A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a ma...

    Published
    MediumCVSS 5.4 EPSS 19.8%

    A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

  6. CVE-2007-5891 Multiple cross-site scripting (XSS) vulnerabilities in jsp/Login.do in ManageEngine OpManager MSP Edition and OpManager 7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) re...

    Published
    MediumCVSS 4.3 EPSS 1.0%

    Multiple cross-site scripting (XSS) vulnerabilities in jsp/Login.do in ManageEngine OpManager MSP Edition and OpManager 7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) requestid, (2) fileid, (3) woMode, and (2) woID parameters. NOTE: the provenance o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.