CVE-2018-16965

—

CVSS 3.0

6.1 medium

EPSS

3%p84

Published

Sep 21, 2018 (Sep 21, 2018)

Modified

Jun 17, 2026

Description

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.

Vendors: zohocorp
Products: manageengine supportcenter plus
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.