CVE-2018-9163

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/103773Third Party Advisory, VDB Entry
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44666/Third Party Advisory, VDB Entry
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350Release Notes
http://www.securityfocus.com/bid/103773Third Party Advisory, VDB Entry
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44666/Third Party Advisory, VDB Entry
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350Release Notes

Timeline

Published: Apr 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-91656.5The pushdup function in util/decompile.c in libming through 0.4.8 does not recognize the need for ActionPushDuplicate to perform a deep copy CVE-2018-91694.8Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an ad CVE-2018-91725.4The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.CVE-2018-91736.1Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inj CVE-2018-91749.8sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents CVE-2018-91759.8DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code CVE-2018-91776.1Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.CVE-2018-91826.1Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.CVE-2018-91835.4The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.CVE-2018-91858.1An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javasc CVE-2018-91866.1A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page a CVE-2018-91905.5A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via t