Stored cross-site scripting in ManageEngine Applications Manager - CVE-2025-27930
Published: July 22, 2025
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the File/Directory monitor. A remote attacker can trick the victim to view the Debug-Info HTML files generated during monitoring and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Note, these HTML files are generated from the monitored file's content, which may allow an attacker to inject and execute arbitrary JavaScript code.