Known vulnerabilities in Zoho ManageEngine SupportCenter Plus

Vendor: Zoho Corporation
Software: Zoho ManageEngine SupportCenter Plus
Software CPE: cpe:2.3:a:zohocorp:zoho_manageengine_supportcenter_plus:*:*:*:*:*:*:*:*
Website: https://www.zohocorp.com/index.html
Total vulnerabilities: 23
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zoho ManageEngine SupportCenter Plus Zoho ManageEngine SupportCenter Plus is affected by 23 known vulnerabilities: 3 high, 12 medium, 8 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU114229 - Incorrect Regular Expression
CVE-2025-8309		 CWE-185 Medium
No
No
 14940 19.08.2025 SB2025081958
SB2025081959
SB2025081960
#VU113365 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-3444		 CWE-98 Medium
No
No
 14920 28.07.2025 SB2025072889
#VU107048 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-50053		 CWE-79 Low
No
No
 14910 07.04.2025 SB2025040723
#VU79907 - Cross-Site Request Forgery (CSRF)
 CWE-352 Medium
No
No
 14304 23.08.2023 SB2023082333
#VU79906 - Information Exposure Through Log Files
 CWE-532 Low
No
No
 14304 23.08.2023 SB2023082333
#VU79905 - Server-Side Request Forgery (SSRF)
 CWE-918 High
No
No
 14304 23.08.2023 SB2023082333
#VU79904 - Exposure of sensitive information to an unauthorized actor
 CWE-200 Medium
No
No
 14304 23.08.2023 SB2023082333
#VU79903 - Improper Authentication
 CWE-287 Medium
No
No
 14304 23.08.2023 SB2023082333
#VU79902 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 14304 23.08.2023 SB2023082333
#VU77579 - Security Features
CVE-2023-35785		 CWE-254 Medium
No
No
 14301 21.06.2023 SB2023062103
SB2023062104
SB2023062105
and 4 more
#VU72431 - Permissions, Privileges, and Access Controls
 CWE-264 Low
No
No
 14001 21.02.2023 SB2023022104
#VU72420 - Cleartext Transmission of Sensitive Information
 CWE-319 Medium
No
No
 14001 20.02.2023 SB2023022032
SB2023022104
#VU72419 - Improper Authentication
 CWE-287 Medium
No
No
 14001 20.02.2023 SB2023022032
SB2023022104
#VU72411 -
Low
No
No
 14001 20.02.2023 SB2023022104
#VU71210 - Improper input validation
CVE-2022-47966		 CWE-20 High
Available
Exploited
 11026 17.01.2023 SB2023011717
SB2023011718
#VU69880 - Permissions, Privileges, and Access Controls
CVE-2022-40773		 CWE-264 Medium
No
No
 11025 05.12.2022 SB2022120535
#VU69872 - Permissions, Privileges, and Access Controls
CVE-2022-40772		 CWE-264 Medium
No
No
 11025 05.12.2022 SB2022120535
#VU69580 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2022-40771		 CWE-611 Low
No
No
 11026 24.11.2022 SB2022112419
SB2022112420
SB2022112421
#VU69556 - Command injection
CVE-2022-40770		 CWE-77 Low
No
No
 11026 24.11.2022 SB2022112404
SB2022112405
SB2022112406
#VU58527 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-43294		 CWE-79 Low
No
No
 11016 06.12.2021 SB2021120607


Showing elements 1 - 20 out of 23