Stored Cross-Site Scripting Vulnerability in Zohocorp ManageEngine Applications Manager
CVE-2025-27930

6.4MEDIUM

Key Information:

Vendor

Manageengine
Status
Applications Manager
Vendor
CVE Published:
23 July 2025

What is CVE-2025-27930?

Zohocorp's ManageEngine Applications Manager versions up to and including 176600 are susceptible to stored cross-site scripting attacks via the File/Directory monitor feature. This vulnerability could allow an attacker to inject malicious scripts into the application, which would then be executed in the context of a user's browser, potentially compromising sensitive data and undermining user trust.

Affected Version(s)

Applications Manager 0 <= 176600

References

https://www.manageengine.com/products/applications_manage...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.