Known vulnerabilities in ManageEngine Applications Manager

Vendor: Zoho Corporation
Software: ManageEngine Applications Manager
Software CPE: cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*
Website: https://www.zohocorp.com/index.html
Total vulnerabilities: 40
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ManageEngine Applications Manager ManageEngine Applications Manager is affected by 40 known vulnerabilities: 18 high, 10 medium, 12 low Critical High Medium Low

Vulnerabilities (40)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU117629 - Security Features
CVE-2025-9223		 CWE-254 Medium
Available
No
 17.8 17820 23.10.2025 SB20251023118
#VU115142 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-9787		 CWE-79 Low
No
No
 17.7 17750 10.09.2025 SB2025091038
#VU113132 - Exposure of sensitive information to an unauthorized actor
CVE-2025-6239		 CWE-200 Low
No
No
 17.6 17690 22.07.2025 SB2025072249
#VU113130 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27930		 CWE-79 Medium
No
No
 17.6 17670 22.07.2025 SB2025072247
#VU103580 - Incorrect Authorization
CVE-2024-41140		 CWE-863 Medium
No
No
 17.4.174000 04.02.2025 SB2025020425
#VU77967 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-38333		 CWE-79 Low
No
No
 16.3 16367, 16.4 16424, 16.5 16512, 16.5 16540 05.07.2023 SB2023070518
#VU76614 - Improper Access Control
 CWE-284 Low
No
No
 16.5 16500 30.05.2023 SB2023053010
#VU75196 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-29442		 CWE-79 Medium
No
No
 16.4 16400 18.04.2023 SB2023041820
#VU72044 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-28341		 CWE-79 Medium
No
No
 16.3 16350 08.02.2023 SB2023020831
#VU72043 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2023-28340		 CWE-611 Medium
No
No
 16.3 16330 08.02.2023 SB2023020830
#VU60629 - Untrusted Search Path
CVE-2022-23050		 CWE-426 Low
No
No
 15.5 15511 16.02.2022 SB2022021601
#VU50400 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-35765		 CWE-89 Medium
No
No
 15.0 05.02.2021 SB2021020604
#VU34836 - Exposure of sensitive information to an unauthorized actor
CVE-2019-19800		 CWE-200 Medium
No
No
 - 06.02.2020 SB2020020629
#VU34877 - Incorrect Default Permissions
CVE-2019-19475		 CWE-276 High
No
No
 - 10.01.2020 SB2020011014
#VU21880 - Improper Authentication
CVE-2019-15106		 CWE-287 High
No
No
 14.3 14310 16.10.2019 SB2019081610
#VU21871 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-15104		 CWE-89 High
No
No
 14.3 14300 16.10.2019 SB2019081609
#VU18628 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2017-11738		 CWE-89 High
No
No
 - 28.05.2019 SB2019052320
#VU35879 - Exposure of sensitive information to an unauthorized actor
CVE-2017-11557		 CWE-200 Medium
No
No
 - 23.05.2019 SB2019052333
#VU35881 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-11739		 CWE-79 Low
No
No
 - 23.05.2019 SB2019052334
#VU35882 - Improper input validation
CVE-2017-11740		 CWE-20 High
No
No
 - 23.05.2019 SB2019052334


Showing elements 1 - 20 out of 40