Zohocorp Manageengine Opmanager vulnerabilities

CVE-2017-11559 [HIGH] CWE-89 CVE-2017-11559: An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/ad An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack.

CVE-2022-35404 [HIGH] CWE-20 CVE-2022-35404: ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to u ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

CVE-2019-12133 [HIGH] CWE-427 CVE-2019-12133: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissio Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged use

CVE-2022-43473 [MEDIUM] CWE-611 CVE-2022-43473: A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of Manage A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

CVE-2019-17421 [HIGH] CWE-276 CVE-2019-17421: Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12. Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

CVE-2017-11561 [MEDIUM] CWE-434 CVE-2017-11561: An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any fi An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell.

CVE-2025-9227 [MEDIUM] CWE-79 CVE-2025-9227: Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.

CVE-2018-18715 [MEDIUM] CWE-79 CVE-2018-18715: Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.

CVE-2018-19288 [MEDIUM] CWE-79 CVE-2018-19288: Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.

CVE-2023-6105 [MEDIUM] CWE-200 CVE-2023-6105: An information disclosure vulnerability exists in multiple ManageEngine products that can result in An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine pr

CVE-2018-18716 [MEDIUM] CWE-79 CVE-2018-18716: Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.

CVE-2018-18262 [MEDIUM] CWE-79 CVE-2018-18262: Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.

CVE-2018-19921 [MEDIUM] CWE-79 CVE-2018-19921: Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.

CVE-2017-11560 [MEDIUM] CWE-79 CVE-2017-11560: An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the applicati An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript

CVE-2018-20339 [MEDIUM] CWE-79 CVE-2018-20339: Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms se Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.

CVE-2025-9226 [MEDIUM] CWE-79 CVE-2025-9226: Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.