| CVE-2025-8309
| AEAsset Explorer ManageEngine | 8.1 | | Aug 20 | User privilege escalation vulnerability |
| CVE-2025-27930
| AMApplications Manager ManageEngine | 5.4 | | Jul 23 | Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor. |
| CVE-2025-5966
| ERExchange Reporter Plus ManageEngine | 8.1 | | Jun 26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. |
| CVE-2025-5366
| ERExchange Reporter Plus ManageEngine | 8.1 | | Jun 26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report. |
| CVE-2025-41444
| AP | 8.3 | | Jun 9 | SQL Injection |
| CVE-2025-36528
| AP | 8.3 | | Jun 9 | SQL Injection |
| CVE-2025-27709
| AP | 8.3 | | Jun 9 | SQL Injection |
| CVE-2025-41437
| OP | 4.3 | | Jun 9 | Reflected XSS |
| CVE-2025-3835
| ERExchange Reporter Plus ManageEngine | 9.6 | | Jun 9 | Remote Code Execution |
| CVE-2025-41407
| AP | 8.3 | | May 23 | SQL Injection |
| CVE-2025-36527
| AP | 8.3 | | May 23 | SQL Injection |
| CVE-2025-41403
| AP | 8.3 | | May 22 | SQL Injection |
| CVE-2025-3836
| AP | 8.3 | | May 22 | SQL Injection |
| CVE-2025-3444
| SPServiceDesk Plus MSP ManageEngine | 6.5 | | May 22 | Local File Inclusion |
| CVE-2025-3834
| AP | 8.1 | | May 14 | SQL Injection |
| CVE-2025-3833
| APADSelfService Plus ManageEngine | 8.1 | | May 14 | SQL Injection |
| CVE-2024-50053
| SPSupportCentre Plus ManageEngine | 5.4 | | Mar 21 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. |
| CVE-2025-1723
| APADSelfService Plus ManageEngine | 8.1 | | Mar 3 | Account takeover |
| CVE-2024-9097
| ECEndpoint Central ManageEngine | 4.3 | | Feb 5 | ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. |
| CVE-2024-41140
| AMApplications Manager ManageEngine | 6.5 | | Jan 29 | Improper Authorization |
| CVE-2024-52323
| APAnalytics Plus ManageEngine | 8.1 | | Nov 27 | Sensitive Data Exposure |
| CVE-2024-49574
| AP | 8.8 | | Nov 18 | SQL Injection |
| CVE-2024-10839
| SMSharePoint Manager Plus ManageEngine | 8.1 | | Nov 8 | XML External Entity |
| CVE-2024-24409
| APADManager Plus ManageEngine | 8.8 | | Nov 8 | Privilege Escalation |
| CVE-2024-10203
| ECEndPoint Central ManageEngine | 7.8 | | Nov 7 | Agent Arbitrary File Deletion |
| CVE-2024-9459
| ERExchange Reporter Plus ManageEngine | 8.8 | | Nov 5 | SQL Injection |
| CVE-2024-36485
| AP | 8.8 | | Nov 4 | SQL Injection |
| CVE-2024-48878
| APADManager Plus ManageEngine | 8.8 | | Nov 4 | SQL Injection |
| CVE-2024-5608
| AP | 8.1 | | Oct 24 | SQL Injection |
| CVE-2024-9100
| APAnalytics Plus ManageEngine | 6.5 | | Oct 3 | Local File Inclusion |
| CVE-2024-38868
| ECEndpoint Central ManageEngine | 8.3 | | Aug 30 | Incorrect Authorization |
| CVE-2024-6204
| ERExchange Reporter Plus ManageEngine | 8.1 | | Aug 30 | SQL injection |
| CVE-2024-5546
| PMPassword Manager Pro ManageEngine | 8.8 | | Aug 28 | SQL Injection |
| CVE-2024-41150
| SPSupportCenter Plus ManageEngine | 6.1 | | Aug 23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: |
| CVE-2024-38869
| ECEndpoint Central ManageEngine | 5.4 | | Aug 23 | Incorrect Authorization |
| CVE-2024-5586
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-5556
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-5490
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-36514
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-36515
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-36516
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-36517
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-5467
| AP | 8.8 | | Aug 23 | SQL Injection |
| CVE-2024-5466
| OROpManager, Remote Monitoring and Management ManageEngine | 8.8 | | Aug 23 | Remote Code Execution |
| CVE-2024-36034
| AP | 8.8 | | Aug 12 | SQL Injection |
| CVE-2024-36035
| AP | 8.8 | | Aug 12 | SQL Injection |
| CVE-2024-36518
| AP | 5.4 | | Aug 12 | SQL Injection |
| CVE-2024-5487
| AP | 8.8 | | Aug 12 | SQL Injection |
| CVE-2024-5527
| AP | 8.8 | | Aug 12 | SQL Injection |
| CVE-2024-5678
| AMApplications Manager ManageEngine | 4.7 | | Aug 1 | SQL Injection |
| CVE-2024-6748
| OP | 8.3 | | Jul 29 | SQL Injection |
| CVE-2024-38872
| ERExchange Reporter Plus ManageEngine | 8.8 | | Jul 26 | SQL Injection |
| CVE-2024-38871
| ERExchange Reporter Plus ManageEngine | 8.8 | | Jul 26 | SQL Injection |
| CVE-2024-38870
| OOOpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition ManageEngine | 3.5 | | Jul 17 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XS |
| CVE-2024-5471
| DC | 9.8 | | Jul 17 | Agent takeover |
| CVE-2024-27311
| DC | 8.8 | | Jul 17 | Arbitrary file writing |
| CVE-2024-27313
| PA | 4.6 | | May 29 | XSS Vulnerability |
| CVE-2024-36037
| AP | 5.5 | | May 27 | Insufficient Access Control Vulnerability |
| CVE-2024-36036
| AP | 4.2 | | May 27 | Insufficient Access Control Vulnerability |
| CVE-2024-27310
| APADSelfService Plus ManageEngine | 6.5 | | May 27 | DOS Vulnerability |
