Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing zoho-subscriptions allows DOM-Based XSS.This issue affects Zoho Billing: from n/a through <= 4.1.

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL Injection.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.7.9.7.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho CRM Zoho CRM Lead Magnet allows Reflected XSS.This issue affects Zoho CRM Lead Magnet: from n/a through 1.7.8.8.

CVE-2022-28810 is a high-severity vulnerability in Zoho ManageEngine ADSelfService Plus that allows remote code execution during password change or reset operations. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

CVE-2022-35405 is a high-severity remote code execution vulnerability affecting multiple Zoho ManageEngine products, including PAM360, Password Manager Pro, and Access Manager Plus. The vulnerability is unspecified in detail but has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Zoho Desktop Central contains an authentication bypass vulnerability (CVE-2021-44515) that allows an attacker to execute arbitrary code on the Desktop Central MSP server. This vulnerability has been exploited in the wild, indicating active attacks. No specific affected versions or patch information is provided in the available data.

CVE-2021-44077 is a high-severity vulnerability in Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus that allows unauthenticated remote code execution. It affects versions of ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014. The vulnerability has been exploited in the wild. No explicit patch information is provided in the input data.

Zoho ManageEngine ServiceDesk Plus versions before 11302 contain an authentication bypass vulnerability that allows certain REST-API URLs to be accessed without authentication. This flaw enables unauthorized users to potentially interact with the service desk application without proper credentials. The vulnerability has been exploited in the wild, indicating active use by attackers. No explicit patch information is provided in the input data.

CVE-2019-8394 is a high-severity vulnerability in Zoho ManageEngine ServiceDesk Plus (SDP) that allows remote attackers to upload files via the login page customization feature. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Zoho ManageEngine Desktop Central has a file upload vulnerability (CVE-2020-10189) that permits unauthenticated remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability in its REST API URLs that allows remote code execution. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. The affected versions are not explicitly stated in the provided data. The severity of this vulnerability is high due to the potential for unauthorized remote code execution.