Sploitus

21 exploited vulnerabilities in Zoho Manageengine Adselfservice Plus

Vulnerabilities with publicly known exploits

Vendors
Manageengine, Microsoft, Zoho
With known exploits
21
Affected Zohocorp Manageengine Adselfservice Plus versions
≤ 5.8, 6.0, 6.1, 5.5, 5.0.6, 4.4, 5.2, 4.5
Affected Netgear ex6100 Firmware versions
= 1.0.2.28_1.1.138
Affected Zohocorp Manageengine Admanager Plus versions
< 6.1

Vulnerabilities with exploits

Highest CVSS first — 10 of these already have exploit code on Sploitus

CVE-2020-11552 3 exploits
CVSS 10.0 CRITICAL 2020-08-11FIX AVAILABLE
ManageEngine ADSelfService Build prior to 6003 - Remote Code Execution (Unauthenticated)ManageEngine ADSelfService Build prior to 6003 - Remote Code Execution (Unauthenticated)
CVE-2021-40539 7 exploits
CVSS 9.8 CRITICAL 2021-09-07FIX AVAILABLE
Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_PlusExploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
CVE-2018-5353 1 exploit
CVSS 9.8 CRITICAL 2020-09-29FIX AVAILABLE
Exploit for Authentication Bypass by Spoofing in Zohocorp Manageengine_Adselfservice_Plus
CVE-2021-33256
CVSS 9.3 HIGH 2021-08-09
CVE-2025-6510
CVSS 9.0 HIGH 2025-03-06
CVE-2021-37419
CVSS 7.5 HIGH 2021-09-21FIX AVAILABLE
CVE-2019-12476 1 exploit
CVSS 7.2 HIGH 2019-06-17FIX AVAILABLE
Exploit for Weak Password Recovery Mechanism for Forgotten Password in Zohocorp Manageengine_Adselfservice_Plus
CVE-2022-28810 3 exploits
CVSS 7.1 HIGH 2022-04-18FIX AVAILABLE
ManageEngine ADSelfService Plus Custom Script ExecutionManageEngine ADSelfService Plus Custom Script Execution Exploit
CVE-2021-37420
CVSS 6.5 MEDIUM 2021-09-21FIX AVAILABLE
CVE-2022-24681
CVSS 6.1 MEDIUM 2022-04-07FIX AVAILABLE
CVE-2021-27956
CVSS 6.1 MEDIUM 2021-05-20FIX AVAILABLE
CVE-2021-27214
CVSS 6.1 MEDIUM 2021-02-19
CVE-2021-31874
CVSS 5.9 MEDIUM 2021-07-02FIX AVAILABLE
CVE-2022-28987
CVSS 5.3 MEDIUM 2022-05-20FIX AVAILABLE
CVE-2021-20147
CVSS 5.3 MEDIUM 2022-01-03FIX AVAILABLE
CVE-2010-3273 1 exploit
CVSS 5.0 MEDIUM 2011-02-17FIX AVAILABLE
Core Security Technologies Advisory 2011.0103
CVE-2021-20148
CVSS 4.3 MEDIUM 2022-01-03FIX AVAILABLE
CVE-2014-3779 1 exploit
CVSS 4.3 MEDIUM 2015-01-07FIX AVAILABLE
ADSelfservice Plus 5.1 Cross Site Scripting
CVE-2011-5105 1 exploit
CVSS 4.3 MEDIUM 2012-08-23FIX AVAILABLE
ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting
CVE-2010-3274 2 exploits
CVSS 4.3 MEDIUM 2011-02-17FIX AVAILABLE
ManageEngine ADSelfService Plus 4.4 - 'EmployeeSearch.cc' Multiple Cross-Site Scripting VulnerabilitiesCore Security Technologies Advisory 2011.0103
CVE-2010-3272 2 exploits
CVSS 4.3 MEDIUM 2011-02-17FIX AVAILABLE
ManageEngine ADSelfService Plus 4.4 - POST Manipulation Security QuestionCore Security Technologies Advisory 2011.0103