Zohocorp Manageengine Applications Manager vulnerabilities

CVE-2026-86683 [HIGH] CWE-20 CVE-2026-86683: ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user t ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.

CVE-2017-11738 [HIGH] CWE-89 CVE-2017-11738: In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/au In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack.

CVE-2016-9489 [HIGH] CWE-269 CVE-2016-9489: In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

CVE-2026-86681 [HIGH] CWE-306 CVE-2026-86681: ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permission ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.

CVE-2022-23050 [HIGH] CWE-427 CVE-2022-23050: ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file t ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality.

CVE-2026-86679 [HIGH] CWE-20 CVE-2026-86679: ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permission ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.

CVE-2019-19799 [MEDIUM] CWE-306 CVE-2019-19799: Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disc Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.

CVE-2023-28340 [MEDIUM] CWE-611 CVE-2023-28340: Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.

CVE-2025-6239 [MEDIUM] CWE-200 CVE-2025-6239: Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information d Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.

CVE-2024-41140 [MEDIUM] CWE-863 CVE-2024-41140: Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.

CVE-2019-19800 [MEDIUM] CWE-306 CVE-2019-19800: Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to d Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.

CVE-2023-29442 [MEDIUM] CWE-79 CVE-2023-29442: Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.

CVE-2021-35512 [MEDIUM] CWE-918 CVE-2021-35512: An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.

CVE-2017-11557 [MEDIUM] CWE-200 CVE-2017-11557: An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauth An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company's network environment via a userconfiguration.do?method=editUser request.

CVE-2024-5678 [MEDIUM] CWE-89 CVE-2024-5678: Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authentic Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature.

CVE-2017-11739 [MEDIUM] CWE-79 CVE-2017-11739: In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrativ In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this fun

CVE-2025-9787 [MEDIUM] CWE-79 CVE-2025-9787: Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross- Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.

CVE-2016-9491 [MEDIUM] CWE-611 CVE-2016-9491: ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administra

CVE-2018-12996 [MEDIUM] CWE-79 CVE-2018-12996: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager befor A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.

CVE-2023-38333 [MEDIUM] CWE-79 CVE-2023-38333: Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.