Back to CVE Browser

CVE-2021-37415

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score87.5150%

EPSS Percentile88.72th

Published2021-09-01

Last Modified2025-10-31

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Affected Platforms (CPE)

📦

Zohocorp

Manageengine Servicedesk Plus

= 11.0= 11.1= 11.2= 11.3

References & Advisories

🔗 https://www.manageengine.com

🔗 https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302

🔗 https://www.manageengine.com

🔗 https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37415

Related Vulnerabilities

CVE-2026-106843.0

In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header ...

CVE-2026-153444.9

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up t...

CVE-2026-555552.3

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the m...

CVE-2026-592488.7

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to...