Zohocorp

Records612All Threatist records

Exploited (KEV)9In CISA KEV

CVSS critical152CVSS 9.0–10.0

CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV

TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CRITICAL 89KEV 2023-03-07 TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2023-01-23 TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2022-09-22 TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-10 TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-01 TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records

Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

14 records in Manageengine Pam360 · all components

TI-2022-23765 CVE-2022-47966 · GHSA-mqq7-v29v-25f6

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003…

CRITICAL 100KEV

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT feature…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99753 Published 2023-01-18 No fix listed CWE-20

TI-2022-15981 CVE-2022-35405 · GHSA-j9c5-6p9g-hwf3

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable…

CRITICAL 100KEV

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99873 Published 2022-07-19 No fix listed CWE-502

TI-2022-21434 CVE-2022-43671 · GHSA-hvv4-8q8q-fp7m

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access…

CRITICAL 88

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7483 Published 2022-11-12 No fix listed CWE-89

TI-2022-19138 CVE-2022-40300 · GHSA-mvcp-j3fp-64mm

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550…

CRITICAL 87

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99123 Published 2022-09-16 No fix listed CWE-89

TI-2022-23597 CVE-2022-47523 · GHSA-jw4x-gv7r-c358

Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and…

CRITICAL 86

Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.70578 Published 2023-01-05 No fix listed CWE-79

TI-2022-21435 CVE-2022-43672 · GHSA-8f8x-4hjh-5xv4

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access…

CRITICAL 85

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.67078 Published 2022-11-12 No fix listed CWE-89

TI-2022-11635 CVE-2022-29081 · GHSA-59xq-494m-chp8

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and…

HIGH 83

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83543 Published 2022-04-28 No fix listed CWE-22

TI-2023-02149 CVE-2023-2291 · GHSA-q9gm-gx3j-8hmm

Hard-coded credentials in Zoho ManageEngine Multiple Products

HIGH 69

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00808 Published 2023-04-26 No fix listed CWE-798

TI-2021-20125 CVE-2021-44525 · GHSA-v79c-w8qr-chq9

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of…

MEDIUM 48

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0354 Published 2021-12-20 No fix listed CWE-287

TI-2024-05154 CVE-2024-5546 · GHSA-9hmf-r3fq-947x

SQL injection in ManageEngine Password Manager Pro

MEDIUM 46

Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulnerability via a global search option.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0304 Published 2024-08-28 Fixed in 12431, 7001 CWE-89

TI-2025-10699 CVE-2025-11669 · GHSA-6ffq-xrg2-pp92

Broken access control in Zohocorp ManageEngine PAM360

LOW 39

Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functional…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00786 Published 2026-01-13 Fixed in 8202, 13221 +1 CWE-862

TI-2024-18150 CVE-2024-27312 · GHSA-35xf-7pfr-g5f5

Authorization vulnerability in PAM360

LOW 39

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00897 Published 2024-05-20 Fixed in 6602 CWE-863

TI-2024-18151 CVE-2024-27313

XSS in ManageEngine PAM360

LOW 31

Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.01294 Published 2024-05-29 Fixed in 6611 CWE-79

TI-2023-05614 CVE-2023-6105 · GHSA-2jvx-3h5f-w2j7

ManageEngine Information Disclosure in Multiple Products

LOW 26

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00694 Published 2023-11-15 Fixed in 14304, 7004 CWE-200

Open these records in search →

Critical	152
High	245
Medium	208
Low	7
No CVSS	0