Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-3274 — Cross-site Scripting in Manageengine Adselfservice Plus

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
14.3%
top 5.58%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Zohocorp Manageengine Adselfservice Plus
Timeline
PublishedFeb 17
Latest updateMay 14

Description

Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-qh63-cgwm-3qjp: Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch↗2022-05-14
▶
CVEList
CVE-2010-3274: Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch↗2011-02-17
▶

💥Exploits & PoCs

1
Exploit-DB
ManageEngine ADSelfService Plus 4.4 - 'EmployeeSearch.cc' Multiple Cross-Site Scripting Vulnerabilities↗2011-02-10
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS ZOHO ManageEngine ADSelfService Employee Search XSS Attempt↗2011-06-09
▶
CVE-2010-3274 — Cross-site Scripting | cvebase