Skip to content
OpenAdvisories

Vendor

Zohocorp

100 known vulnerabilities.

Products

ManageEngine Exchange Reporter Plus 15 ManageEngine OpManager 13 DDI Central 12 ManageEngine Applications Manager 9 ManageEngine Firewall Analyzer 7 ManageEngine Key Manager Plus 7 ManageEngine ADSelfService Plus 7 ManageEngine Password Manager Pro 6 ManageEngine PAM360 6 ManageEngine Endpoint Central 6 Log360 3 EventLog Analyzer 3 ManageEngine ADManager Plus 3 Endpoint Central 3 ManageEngine ADAudit Plus 2 ManageEngine Network Configuration Manager 2 ManageEngine DataSecurity Plus 2 manageengine_m365_manager_plus 2 ManageEngine Access Manager Plus 2 ADAudit Plus 2 ManageEngine NetFlow Analyzer 2 ManageEngine Log360 2 Analytics Plus 2 ManageEngine M365 Security Plus 1 ManageEngine OpUtils 1 ManageEngine Malware Protection Plus 1 ManageEngine Analytics Plus 1 ManageEngine RecoveryManager Plus 1 AssetExplorer 1 ServiceDesk Plus 1 ServiceDesk Plus MSP 1 SupportCenter Plus 1 M365 Manager Plus 1 Zoho Mail wordpress plugin 1 manageengine_ddi_central 1 manageengine_recovery_manager_plus 1 DataSecurity Plus 1 ManageEngine Eventlog Analyzer 1
All Critical High Medium Low Exploited only Public exploit

100 results · Feed

  • Medium 6.1
    CVE-2025-9787

    Stored XSS

    Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.

    Zohocorp ManageEngine Applications Manager
  • Medium 6.4
    CVE-2025-11670

    NTLM Hash Exposure Vulnerability

    Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.  This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.

    Zohocorp ManageEngine ADManager Plus
  • Medium 6.5
    CVE-2025-9227

    Stored XSS

    Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.

    Zohocorp ManageEngine OpManager
  • High 8.8
    CVE-2025-9223 Public exploit

    Command Injection

    Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

    Zohocorp ManageEngine Applications Manager
  • Critical 9.8
    CVE-2025-8324

    SQL Injection

    Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

    Zohocorp ManageEngine Analytics Plus
  • High 7.3
    CVE-2025-7633

    Stored XSS

    Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.

    Zohocorp ManageEngine Exchange Reporter Plus
  • High 7.3
    CVE-2025-7632

    Stored XSS

    Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.

    Zohocorp ManageEngine Exchange Reporter Plus
  • High 7.3
    CVE-2025-7430

    Stored XSS

    Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.

    Zohocorp ManageEngine Exchange Reporter Plus
  • High 7.3
    CVE-2025-7429

    Stored XSS

    Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.

    Zohocorp ManageEngine Exchange Reporter Plus
  • Medium 6.3
    CVE-2025-5347

    Stored XSS

    Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.

    Zohocorp ManageEngine Exchange Reporter Plus
  • Medium 6.3
    CVE-2025-5343

    Stored XSS

    Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.

    Zohocorp ManageEngine Exchange Reporter Plus
  • Medium 4.3
    CVE-2025-5342

    Denial of Service (DoS)

    Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.

    Zohocorp ManageEngine Exchange Reporter Plus
  • Low 3.2
    CVE-2025-11248

    Sensitive Information Logged

    ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.

    Zohocorp ManageEngine Endpoint Central
  • Medium 6.5
    CVE-2025-6239

    Information disclosure

    Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.

    Zohocorp ManageEngine Applications Manager
  • High 8.5
    CVE-2025-10020

    Command Injection

    Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.

    Zohocorp ManageEngine ADManager Plus
  • High 8.3
    CVE-2025-9428 EPSS 29%

    SQL Injection

    Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.

    Zohocorp Analytics Plus
  • Medium 5.2
    CVE-2025-7473

    XML Injection

    Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

    Zohocorp Endpoint Central
  • Low 3.3
    CVE-2025-5496

    Arbitrary File Deletion

    ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.

    Zohocorp Endpoint Central
  • Low 3.9
    CVE-2025-5494

    Privilege Escalation

    ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.

    Zohocorp Endpoint Central
  • High 7.4
    CVE-2025-1724

    Account Takeover

    Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.

    Zohocorp Analytics Plus