Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-8394 1 Zohocorp 1 Manageengine Servicedesk Plus 2025-11-07 7.5 High
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
CVE-2021-31531 1 Zohocorp 1 Manageengine Servicedesk Plus Msp 2025-05-30 9.8 Critical
Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2021-31530 1 Zohocorp 1 Manageengine Servicedesk Plus Msp 2025-05-30 7.5 High
Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
CVE-2021-31160 1 Zohocorp 2 Manageengine Servicedesk Plus, Manageengine Servicedesk Plus Msp 2025-05-30 7.5 High
Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
CVE-2021-31159 1 Zohocorp 1 Manageengine Servicedesk Plus Msp 2024-11-21 5.3 Medium
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.
CVE-2021-20081 2 Microsoft, Zohocorp 2 Windows, Manageengine Servicedesk Plus 2024-11-21 7.2 High
Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.
CVE-2021-20080 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 6.1 Medium
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
CVE-2020-6843 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 4.8 Medium
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
CVE-2020-35682 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 8.8 High
Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).
CVE-2020-14048 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 7.5 High
Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.
CVE-2020-13154 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 6.5 Medium
Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet.
CVE-2019-8395 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
CVE-2019-15083 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 6.1 Medium
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
CVE-2019-15046 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 7.5 High
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
CVE-2019-15045 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
CVE-2019-12543 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
CVE-2019-12542 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
CVE-2019-12541 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
CVE-2019-12540 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
CVE-2019-12539 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 6.1 Medium
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.