Zohocorp Manageengine Applications Manager vulnerabilities

CVE-2017-16848 [CRITICAL] CWE-89 CVE-2017-16848: Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.

CVE-2025-9223 [HIGH] CWE-77 CVE-2025-9223: Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

CVE-2019-19649 [CRITICAL] CWE-89 CVE-2019-19649: Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection vi Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function.

CVE-2018-11808 [CRITICAL] CWE-20 CVE-2018-11808: Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Versio Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.

CVE-2020-27995 [CRITICAL] CWE-89 CVE-2020-27995: SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execut SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter.

CVE-2018-15168 [CRITICAL] CWE-89 CVE-2018-15168: A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 1 A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request.

CVE-2020-15533 [CRITICAL] CWE-89 CVE-2020-15533: In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750 In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack.

CVE-2020-27733 [HIGH] CWE-89 CVE-2020-27733: Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection v Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request.

CVE-2023-28341 [MEDIUM] CWE-79 CVE-2023-28341: Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16 Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page.

CVE-2018-16364 [HIGH] CWE-502 CVE-2018-16364: A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows fo A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

CVE-2019-19475 [HIGH] CWE-276 CVE-2019-19475: An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated Postgre An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation and modify PostgreSQL configuration to execute arbitrar

CVE-2019-19650 [HIGH] CWE-89 CVE-2019-19650: Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function.

CVE-2021-31813 [MEDIUM] CWE-79 CVE-2021-31813: Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing mali Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.

CVE-2020-28679 [HIGH] CWE-89 CVE-2020-28679: A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 145 A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request.

CVE-2020-24743 [CRITICAL] CVE-2020-24743: An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows att An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter.

CVE-2017-11740 [HIGH] CWE-20 CVE-2017-11740: In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability t In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system.

CVE-2020-10816 [HIGH] CWE-287 CVE-2020-10816: Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet.

CVE-2017-11738 [HIGH] CWE-89 CVE-2017-11738: In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/au In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack.

CVE-2016-9489 [HIGH] CWE-269 CVE-2016-9489: In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

CVE-2022-23050 [HIGH] CWE-427 CVE-2022-23050: ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file t ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality.