CVE-2024-36038

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy server option.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ManageEngineOpManager>= 128234, < 128248

References

Timeline

Published
Jun 24, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-360396.3PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.CVE-2024-36048.8The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode CVE-2024-360417.8KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on CVE-2024-360429.8Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticCVE-2024-360436.1question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.CVE-2024-360469.8Infoblox NIOS through 8.6.4 executes with more privileges than required.CVE-2024-360479.8Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.CVE-2024-360489.8QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.CVE-2024-360496.5Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and pasCVE-2024-36059.8The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms RECVE-2024-360504.3Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attackerCVE-2024-360527.5RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-202