{"cve":"CVE-2019-18411","nvd":{"published":"2019-11-06T22:15:10.380","modified":"2026-06-17T02:24:59.030","status":"Modified","description":"Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-352"],"references":["https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae","https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae"],"products":["zohocorp:manageengine_adselfservice_plus"],"source":"nvd","synced_at":"2026-10-19T20:59:25.448946135+00:00"},"epss":{"cve":"CVE-2019-18411","score":0.02335,"percentile":0.8358,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}