CVE-2018-9163

PoC —

CVSS 3.0

5.4 medium

EPSS

5%p92

Published

Apr 2, 2018 (Apr 2, 2018)

Modified

Jun 17, 2026

Description

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

Vendors: zohocorp
Products: manageengine recovery manager plus
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (4.9%)

In the news0 stories

No ingested article mentions this CVE yet.