Skip to content

Product

ManageEngine supportcenter plus vulnerabilities

5 published CVES affecting ManageEngine supportcenter plus, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
5
Critical
0
High
1
Medium
3
Low
1
Unscored
0
CISA KEV
0

Latest ManageEngine supportcenter plus CVEs

Newest publication first

  1. CVE-2025-8309 User privilege escalation vulnerability

    Published
    HighCVSS 8.1 EPSS 0.30%

    There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions befo...

  2. CVE-2025-3444 Local File Inclusion

    Published
    MediumCVSS 6.5 EPSS 1.6%

    Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

  3. CVE-2024-41150 Stored XSS

    Published
    MediumCVSS 6.1 EPSS 1.3%

    An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through...

  4. CVE-2024-27314 Stored XSS Vulnerability

    Published
    LowCVSS 2.4 EPSS 1.9%

    Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.

  5. CVE-2008-1432 Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a re...

    Published
    MediumCVSS 4.3 EPSS 0.86%

    Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299. NOTE: the provenance of this information is unknow...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.