CVE-2018-9163

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 5.0%

from disclosure to weapon49 days

Published on NVDApr 2

1st PoC+49d

exploitation probability

5.0%top 9% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/44666/unverified exploitdbwww.exploit-db.com/exploits/44666unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/https://www.exploit-db.com/exploits/44666/https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350 http://www.securityfocus.com/bid/103773