CVE-2017-11685

Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter.

• CWE-79

• http://init6.me/exploiting-manageengine-eventlog-analyzer.htmlExploit, Technical Description, Third Party Advisory
• http://init6.me/exploiting-manageengine-eventlog-analyzer.htmlExploit, Technical Description, Third Party Advisory

Published

Jul 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1168IBM Rational Engineering Lifecycle Manager 4.0, 5.0, and 6.0…
• CVE-2017-11680Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.…
• CVE-2017-11681Incorrect Access Control vulnerability in Hashtopussy 0.4.0 …
• CVE-2017-11682Stored Cross-site scripting vulnerability in Hashtopussy 0.4…6.1
• CVE-2017-11683There is a reachable assertion in the Internal::TiffReader::…6.5
• CVE-2017-11684There is an illegal address access in the build_table functi…
• CVE-2017-11686Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows re…
• CVE-2017-11687Multiple Persistent cross-site scripting (XSS) vulnerabiliti…
• CVE-2017-1169IBM DOORS next Generation (DNG/RRC) is vulnerable to cross-s…
• CVE-2017-11691Cross-site scripting (XSS) vulnerability in auth_profile.php…
• CVE-2017-11692The function "Token& Scanner::peek" in scanner.cpp in yaml-c…
• CVE-2017-11693MEDHOST Document Management System contains hard-coded crede…