| CVE-2025-9787 | 中6.1 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. | 18/12/2025 |
| CVE-2025-6239 | 中6.5 | Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. | 21/10/2025 |
| CVE-2025-27930 | 中5.4 | Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor. | 23/07/2025 |
| CVE-2024-41140 | 中6.5 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. | 29/01/2025 |
| CVE-2024-5678 | 中4.7 | Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. | 01/08/2024 |
| CVE-2023-38333 | 中6.1 | Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. | 10/08/2023 |
| CVE-2023-29442 | 中6.1 | Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. | 26/04/2023 |
| CVE-2023-28341 | 中6.1 | Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page. | 11/04/2023 |
| CVE-2023-28340 | 中6.5 | Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. | 11/04/2023 |
| CVE-2022-23050 | 高7.2 | ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality. | 24/05/2022 |
| CVE-2020-28679 | 高8.8 | A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request. | 10/01/2022 |
| CVE-2020-24743 | 緊急9.8 | An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter. | 03/11/2021 |
| CVE-2021-35512 | 中6.5 | An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. | 21/10/2021 |
| CVE-2021-31813 | 中5.4 | Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. | 01/07/2021 |
| CVE-2020-35765 | 高8.8 | doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do. | 05/02/2021 |
| CVE-2020-27733 | 高8.8 | Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request. | 19/01/2021 |
| CVE-2020-27995 | 緊急9.8 | SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter. | 29/10/2020 |
| CVE-2020-10816 | 高7.5 | Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet. | 08/10/2020 |
| CVE-2020-16267 | 高8.8 | Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module. | 06/10/2020 |
| CVE-2020-15927 | 高8.8 | Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. | 06/10/2020 |