CVE-2019-16268

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/Exploit, Third Party Advisory
https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.htmlVendor Advisory
https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/Exploit, Third Party Advisory
https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.htmlVendor Advisory

Timeline

Published: Feb 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-16276.5A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gai CVE-2019-162715.3DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on CVE-2019-162729.8On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement.CVE-2019-162739.8DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading to arbitrary code ex CVE-2019-162747.5DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.CVE-2019-162756.5hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source addre CVE-2019-162767.5Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.CVE-2019-162777.8PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c.CVE-2019-162789.8Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c CVE-2019-162797.5A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted H CVE-2019-16285.5A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to cause a bu CVE-2019-162817.5Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block.