Sploitus

CVE-2021-40539

13 known exploits for CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Affected products
Zoho Manageengine Adselfservice Plus
Zohocorp Manageengine Adselfservice Plus
< 6.1
Fix
Available
CVSS 3.1
9.8 CRITICAL
EPSS
99.0% (100th percentile)
Weakness
CWE-706
NVD status
Analyzed
Published
2021-09-07
CVE-2021-40539 at NVD
Authoritative description, scoring and affected products

13 known exploits for CVE-2021-40539

Proof-of-concept code and exploit modules indexed by Sploitus

CVE-2021-40539
2026-08-27 KitPloitKITPLOIT
CVE-2021-40539
2026-08-27 KitPloitKITPLOIT
CVE-2021-40539
2026-08-27 KitPloitKITPLOIT
ADSelfService-Plus-RCE-CVE-2021-40539
2026-08-26 KitPloitKITPLOIT
CVE-2021-40539
2026-08-26 KitPloitKITPLOIT
APT-Backpack
2026-08-24 KitPloitKITPLOIT
Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
2024-10-16 Bu0uCatGITHUB
Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
2024-10-12 lpyydxsGITHUB
Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
2024-10-12 lpyzdsGITHUB
ManageEngine ADSelfService Plus Authentication Bypass / Code Execution Exploit
2021-11-27 metasploitZDTRuby
ManageEngine ADSelfService Plus Authentication Bypass / Code Execution
2021-11-27 mr_mePACKETSTORMRuby
Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
2021-11-03 synacktivGITHUB
ManageEngine ADSelfService Plus CVE-2021-40539
2021-09-07 Antoine Cervoise, Wilfried Bécard, mr_me, wvu <wvu@metasploit.com>METASPLOITRuby