Manageengine Servicedesk Plus vulnerabilities | LiveThreat CVE Feed

Product

Manageengine Servicedesk Plus

by Zohocorp · last CVE Mar 21, 2025

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities50 In the news0 Timeline

Severity mix

Critical 5High 11Medium 33Low 1

Severity

All severities50 Critical5 High11 Medium33 Low1

Exploitation

On CISA KEV4 Exploited in the wild4

Watch

Add Manageengine Servicedesk Plus to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2019-8394 In wildKEV	6.5	63%	Feb 17	Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability Affected: before 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +8 more
CVE-2023-26600	6.5	6%	Mar 6	ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via… Affected: before 14.1; 14.1; 14.1; 14.1; 14.1; 14.1
CVE-2022-40772	6.5	3%	Nov 23	Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module Affected: before 14.0; 14.0; 14.0
CVE-2020-13154	6.5	3%	May 18	Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to… Affected: 11.1; 11.1; 11.1; 11.1; 11.1; 11.1; +7 more
CVE-2019-12252	6.5	8%	May 21	In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the… Affected: through 10.5
CVE-2017-9376	6.5	7%	Mar 25	ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do Affected: before 9.3
CVE-2024-41150	6.1	1%	Aug 23	An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: Affected: through 14.7; 14.8
CVE-2023-23078	6.1	3%	Feb 1	Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +2 more
CVE-2023-23077	6.1	3%	Feb 1	Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +8 more
CVE-2023-23074	6.1	84%	Feb 1	Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +2 more
CVE-2023-23073	6.1	3%	Feb 1	Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +2 more
CVE-2021-20080	6.1	93%	Apr 9	Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker… Affected: 8.1; 8.2; 8.2; 8.2; 8.2; 8.2; +34 more
CVE-2019-15083	6.1	6%	May 14	Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator Affected: 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +17 more
CVE-2019-12540	6.1	2%	Jul 11	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5 Affected: 10.5
CVE-2019-12539	6.1	3%	Jul 11	An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus Affected: 10.5
CVE-2019-12543	6.1	6%	Jun 5	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3
CVE-2019-12542	6.1	6%	Jun 5	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3
CVE-2019-12541	6.1	6%	Jun 5	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3
CVE-2019-12538	6.1	6%	Jun 5	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3
CVE-2019-12189	6.1	6%	May 21	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3
CVE-2018-5799	6.1	2%	Mar 30	In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-69139 Affected: before 9403
CVE-2023-6105	5.5	1%	Nov 15	ManageEngine Information Disclosure in Multiple Products Affected: before 14.3; 14.3; 14.3; 14.3; 14.3
CVE-2024-50053	5.4	1%	Mar 21	Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. Affected: before 14.9; 14.9; 14.9
CVE-2024-38869	5.4	1%	Aug 23	Incorrect Authorization Affected: through 14.7; 14.8
CVE-2023-34197	5.4	4%	Jul 7	Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release… Affected: before 14.2; 14.2; 14.2
CVE-2022-25245	5.3	1%	Apr 5	Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name Affected: through 12.0; 13.0
CVE-2019-15045	5.3	5%	Aug 21	AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration Affected: 10 before 10509
CVE-2018-7248	5.3	6%	May 11	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317 Affected: 9.3
CVE-2023-29443	4.9	3%	Apr 26	Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to… Affected: before 14.1; 14.1; 14.1; 14.1; 14.1; 14.1; +1 more
CVE-2022-40771	4.9	4%	Nov 23	Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure Affected: before 14.0; 14.0; 14.0
CVE-2021-46065	4.8	92%	Jan 27	A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code Affected: 11.3
CVE-2020-6843	4.8	2%	Jan 23	Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS Affected: through 11.0
CVE-2019-10273	4.3	8%	Apr 4	Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users Affected: 9.3