Skip to content
BackEsc
Connect AISign inSign up free

Zoho (ManageEngine) · weakness class

File and Path Handling

82 CVEs · 1 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Connect AI

exploited in the wild
1
check available
6
likely to be exploited
36

Every one of the 82 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.CVE-2019-8394Zoho · CVSS 7.5 · 63% likely

    CWE-434

  2. ZOHO WebNMS Framework <5.2 SP1 - Local File InclusionCVE-2016-6601Zohocorp · 98% likely

    CWE-22

  3. Zoho ManageEngine OpManger - Arbitrary File ReadCVE-2020-12116Zohocorp · 97% likely

    CWE-22

  4. Zoho ManageEngine - Access Control BypassCVE-2022-29081Zohocorp · 84% likely

    CWE-22

  5. ManageEngine ServiceDesk 9.3.9328 - Arbitrary File RetrievalCVE-2017-11512Zoho · 80% likely

    CWE-22

  6. ManageEngine OpManager - Directory TraversalCVE-2023-47211ManageEngine · CVSS 9.1 · 47% likely

    CWE-22

  7. ManageEngine Firewall Analyzer <8.0 - Local File InclusionCVE-2015-7780Zohocorp · 11% likely

    CWE-22

  8. Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read…CVE-2014-5445Zohocorp · 98% likely

    CWE-22

  9. Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.CVE-2021-37539Zohocorp · 93% likely

    CWE-434

  10. Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a…CVE-2016-6600Zohocorp · 91% likely

    CWE-22

  11. Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary…CVE-2014-6037Zohocorp · 84% likely

    CWE-22

  12. Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or rem…CVE-2014-7866Zohocorp · 80% likely

    CWE-22

  13. Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus…CVE-2014-6034Zohocorp · 79% likely

    CWE-22

  14. Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.CVE-2014-5301Manageengine · 78% likely

    CWE-22

  15. Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileNa…CVE-2014-5005Zohocorp · 78% likely

    CWE-22

  16. Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code b…CVE-2013-7390Zohocorp · 75% likely

    CWE-434

  17. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37926Zohocorp · 74% likely

    CWE-434

  18. Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37918Zohocorp · 74% likely

    CWE-434

  19. The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.CVE-2015-8249Manageengine · 74% likely

    CWE-434

  20. Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the att…CVE-2014-100002Zohocorp · 60% likely

    CWE-22

  21. Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remo…CVE-2021-20078Zohocorp · 59% likely

    CWE-22

  22. Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authentic…CVE-2014-5446Zohocorp · 55% likely

    CWE-22

  23. Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.CVE-2020-14008Zohocorp · 40% likely

    CWE-434

  24. Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in t…CVE-2011-2757Manageengine · 39% likely

    CWE-22

  25. In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.CVE-2020-13818Zohocorp · 38% likely

    CWE-22

  26. Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 bu…CVE-2014-5007Zohocorp · 37% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated