Unscored CVE-2018-16965 EUVD-2018-8753GHSA-wpq6-4pw8-8qgh

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contra…

Published Sep 21, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.

References

http://packetstormsecurity.com/files/149438/ManageEngine-SupportCenter-Plus-8.1.0-Cross-Site-Scripting.html
https://pitstop.manageengine.com/portal/community/topic/supportcenter-plus-version-8-1-build-8109-released