CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2018-9163
Medium (5.4) in zohocorp manageengine recovery manager plus. EPSS 4.8% chance of exploitation in the next 30 days.
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.
Severity
- EPSS
- 4.8% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zohocorp:manageengine_recovery_manager_plus
References
- http://www.securityfocus.com/bid/103773
- https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/
- https://www.exploit-db.com/exploits/44666/
- https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350
- http://www.securityfocus.com/bid/103773