← Vulnerability feed

Vulnerability record · CVE-2019-16268 · published 3 February 2021

CVE-2019-16268: Zohocorp manageengine remote access plus cross-site scripting vulnerability

Zohocorp · Manageengine Remote Access Plus

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

4.8 CVSS 3.1 Medium EPSS 1.8% · top 22.2% CWE-79 · Cross-site scripting
4.8CVSS 3.1 base score, v2 3.5
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengi ExploitThird Party Advisory
https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html Vendor Advisory
https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengi ExploitThird Party Advisory
https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html Vendor Advisory

Track CVE-2019-16268 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-47966Zoho ManageEngine on-premise products RCE via SAML SSO and xmlsecMultiple Zoho ManageEngine on-premise products use Apache Santuario xmlsec 1.4.1, whose XSLT features by design leave certain security protections to…KEVEPSS 100%analysed8.8CVE-2019-11361Zohocorp manageengine remote access plus incorrect authorization vulnerabilityZoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full ap…EPSS 3.0%8.1CVE-2020-15589Zohocorp manageengine desktop central vulnerabilityA design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEn…EPSS 8.3%7.8CVE-2021-42954Zohocorp manageengine remote access plus incorrect permission assignment vulnerabilityZoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is v…EPSS 0.39%7.8CVE-2021-42955Zohocorp manageengine remote access plus incorrect permission assignment vulnerabilityZoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because…EPSS 0.43%7.5CVE-2021-41829Zohocorp manageengine remote access plus vulnerabilityZoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.EPSS 3.2%7.5CVE-2021-41827Zohocorp manageengine remote access plus hard-coded credentials vulnerabilityZoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that c…EPSS 4.7%7.5CVE-2021-41828Zohocorp manageengine remote access plus hard-coded credentials vulnerabilityZoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.EPSS 4.7%

Source: NIST National Vulnerability Database (record CVE-2019-16268), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.