# cve.now: Manageengine

The newest entries naming Manageengine as an affected vendor (up to 200), of 88 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119682](https://cve.now/CVE-2026-119682.md): Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus (CVSS 7.9)
- [CVE-2026-119680](https://cve.now/CVE-2026-119680.md): Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature (CVSS 8.5)
- [CVE-2025-8309](https://cve.now/CVE-2025-8309.md): User privilege escalation vulnerability (CVSS 8.1)
- [CVE-2025-27930](https://cve.now/CVE-2025-27930.md): Stored XSS (CVSS 6.4)
- [CVE-2025-5966](https://cve.now/CVE-2025-5966.md): Stored XSS (CVSS 8.1)
- [CVE-2025-5366](https://cve.now/CVE-2025-5366.md): Stored XSS (CVSS 8.1)
- [CVE-2025-41444](https://cve.now/CVE-2025-41444.md): SQL Injection (CVSS 8.3)
- [CVE-2025-36528](https://cve.now/CVE-2025-36528.md): SQL Injection (CVSS 8.3)
- [CVE-2025-27709](https://cve.now/CVE-2025-27709.md): SQL Injection (CVSS 8.3)
- [CVE-2025-41437](https://cve.now/CVE-2025-41437.md): Reflected XSS (CVSS 4.3)
- [CVE-2025-3835](https://cve.now/CVE-2025-3835.md): Remote Code Execution (CVSS 9.6)
- [CVE-2025-41407](https://cve.now/CVE-2025-41407.md): SQL Injection (CVSS 8.3)
- [CVE-2025-36527](https://cve.now/CVE-2025-36527.md): SQL Injection (CVSS 8.3)
- [CVE-2025-41403](https://cve.now/CVE-2025-41403.md): SQL Injection (CVSS 8.3)
- [CVE-2025-3836](https://cve.now/CVE-2025-3836.md): SQL Injection (CVSS 8.3)
- [CVE-2025-3444](https://cve.now/CVE-2025-3444.md): Local File Inclusion (CVSS 6.5)
- [CVE-2025-3834](https://cve.now/CVE-2025-3834.md): SQL Injection (CVSS 8.1)
- [CVE-2025-3833](https://cve.now/CVE-2025-3833.md): SQL Injection (CVSS 8.1)
- [CVE-2024-50053](https://cve.now/CVE-2024-50053.md): Stored XSS (CVSS 6.3)
- [CVE-2025-1723](https://cve.now/CVE-2025-1723.md): Account takeover (CVSS 8.1)
- [CVE-2024-9097](https://cve.now/CVE-2024-9097.md): IDOR (CVSS 3.5)
- [CVE-2024-41140](https://cve.now/CVE-2024-41140.md): Improper Authorization (CVSS 8.1)
- [CVE-2024-52323](https://cve.now/CVE-2024-52323.md): Sensitive Data Exposure (CVSS 8.1)
- [CVE-2024-49574](https://cve.now/CVE-2024-49574.md): SQL Injection (CVSS 8.3)
- [CVE-2024-10839](https://cve.now/CVE-2024-10839.md): XML External Entity (CVSS 8.5)
- [CVE-2024-24409](https://cve.now/CVE-2024-24409.md): Privilege Escalation (CVSS 8.8)
- [CVE-2024-10203](https://cve.now/CVE-2024-10203.md): Agent Arbitrary File Deletion (CVSS 7.0)
- [CVE-2024-9459](https://cve.now/CVE-2024-9459.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36485](https://cve.now/CVE-2024-36485.md): SQL Injection (CVSS 8.3)
- [CVE-2024-48878](https://cve.now/CVE-2024-48878.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5608](https://cve.now/CVE-2024-5608.md): SQL Injection (CVSS 8.3)
- [CVE-2024-9100](https://cve.now/CVE-2024-9100.md): Local File Inclusion (CVSS 6.5)
- [CVE-2024-38868](https://cve.now/CVE-2024-38868.md): Incorrect Authorization (CVSS 7.6)
- [CVE-2024-6204](https://cve.now/CVE-2024-6204.md): SQL injection (CVSS 8.3)
- [CVE-2024-5546](https://cve.now/CVE-2024-5546.md): SQL Injection (CVSS 8.3)
- [CVE-2024-41150](https://cve.now/CVE-2024-41150.md): Stored XSS (CVSS 6.3)
- [CVE-2024-38869](https://cve.now/CVE-2024-38869.md): Incorrect Authorization (CVSS 8.3)
- [CVE-2024-5586](https://cve.now/CVE-2024-5586.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5556](https://cve.now/CVE-2024-5556.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5490](https://cve.now/CVE-2024-5490.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36514](https://cve.now/CVE-2024-36514.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36515](https://cve.now/CVE-2024-36515.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36516](https://cve.now/CVE-2024-36516.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36517](https://cve.now/CVE-2024-36517.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5467](https://cve.now/CVE-2024-5467.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5466](https://cve.now/CVE-2024-5466.md): Remote Code Execution (CVSS 8.8)
- [CVE-2024-36034](https://cve.now/CVE-2024-36034.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36035](https://cve.now/CVE-2024-36035.md): SQL Injection (CVSS 8.3)
- [CVE-2024-36518](https://cve.now/CVE-2024-36518.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5487](https://cve.now/CVE-2024-5487.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5527](https://cve.now/CVE-2024-5527.md): SQL Injection (CVSS 8.3)
- [CVE-2024-5678](https://cve.now/CVE-2024-5678.md): SQL Injection (CVSS 4.7)
- [CVE-2024-6748](https://cve.now/CVE-2024-6748.md): SQL Injection (CVSS 8.3)
- [CVE-2024-38872](https://cve.now/CVE-2024-38872.md): SQL Injection (CVSS 8.3)
- [CVE-2024-38871](https://cve.now/CVE-2024-38871.md): SQL Injection (CVSS 8.3)
- [CVE-2024-38870](https://cve.now/CVE-2024-38870.md): Stored XSS (CVSS 3.5)
- [CVE-2024-5471](https://cve.now/CVE-2024-5471.md): Agent takeover (CVSS 8.8)
- [CVE-2024-27311](https://cve.now/CVE-2024-27311.md): Arbitrary file writing (CVSS 5.5)
- [CVE-2024-36038](https://cve.now/CVE-2024-36038.md): Stored XSS (CVSS 6.3)
- [CVE-2024-27313](https://cve.now/CVE-2024-27313.md): XSS Vulnerability (CVSS 6.3)
- [CVE-2024-36037](https://cve.now/CVE-2024-36037.md): Insufficient Access Control Vulnerability (CVSS 5.5)
- [CVE-2024-36036](https://cve.now/CVE-2024-36036.md): Insufficient Access Control Vulnerability (CVSS 4.2)
- [CVE-2024-27310](https://cve.now/CVE-2024-27310.md): DOS Vulnerability (CVSS 5.3)
- [CVE-2024-27314](https://cve.now/CVE-2024-27314.md): Stored XSS Vulnerability (CVSS 2.4)
- [CVE-2024-21791](https://cve.now/CVE-2024-21791.md): SQL Injection in ADAudit Plus (CVSS 4.7)
- [CVE-2023-49335](https://cve.now/CVE-2023-49335.md): Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details. (CVSS 8.3)
- [CVE-2023-49334](https://cve.now/CVE-2023-49334.md): Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report. (CVSS 8.3)
- [CVE-2023-49333](https://cve.now/CVE-2023-49333.md): Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature. (CVSS 8.3)
- [CVE-2023-49332](https://cve.now/CVE-2023-49332.md): Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares. (CVSS 8.3)
- [CVE-2023-49331](https://cve.now/CVE-2023-49331.md): Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option. (CVSS 8.3)
- [CVE-2024-27312](https://cve.now/CVE-2024-27312.md): Authorization vulnerability in PAM360 (CVSS 8.1)
- [CVE-2023-49330](https://cve.now/CVE-2023-49330.md): Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data. (CVSS 8.3)
- [CVE-2024-21775](https://cve.now/CVE-2024-21775.md): SQL Injection (CVSS 8.3)
- [CVE-2024-0269](https://cve.now/CVE-2024-0269.md): SQL Injection (CVSS 8.3)
- [CVE-2024-0253](https://cve.now/CVE-2024-0253.md): SQL Injection (CVSS 8.3)
- [CVE-2024-0252](https://cve.now/CVE-2024-0252.md): Remote code execution (CVSS 8.8)
- [CVE-2023-47211](https://cve.now/CVE-2023-47211.md): A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. (CVSS 9.1)
- [CVE-2023-6105](https://cve.now/CVE-2023-6105.md): ManageEngine Information Disclosure in Multiple Products (CVSS 5.5)
- [CVE-2023-4769](https://cve.now/CVE-2023-4769.md): Server-Side Request Forgery in ManageEngine Desktop Central (CVSS 6.6)
- [CVE-2023-4768](https://cve.now/CVE-2023-4768.md): Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central (CVSS 6.1)
- [CVE-2023-4767](https://cve.now/CVE-2023-4767.md): Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central (CVSS 6.1)
- [CVE-2023-35719](https://cve.now/CVE-2023-35719.md): ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability (CVSS 6.8)
- [CVE-2022-43473](https://cve.now/CVE-2022-43473.md): A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. (CVSS 5.8)
- [CVE-2016-9498](https://cve.now/CVE-2016-9498.md): ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects (no CVSS)
- [CVE-2016-9491](https://cve.now/CVE-2016-9491.md): ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity (no CVSS)
- [CVE-2016-9489](https://cve.now/CVE-2016-9489.md): ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass (no CVSS)
- [CVE-2016-9490](https://cve.now/CVE-2016-9490.md): ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability (no CVSS)
- [CVE-2016-9488](https://cve.now/CVE-2016-9488.md): ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/manageengine
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.