CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.

• CWE-20

• http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/74Exploit, Mailing List, Third Party Advisory
• http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-035Exploit, Third Party Advisory
• https://github.com/unh3x/just4cve/issues/9Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/74Exploit, Mailing List, Third Party Advisory
• http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-035Exploit, Third Party Advisory
• https://github.com/unh3x/just4cve/issues/9Exploit, Third Party Advisory

Published

Jun 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12993onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12994onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12995onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12996A reflected Cross-site scripting (XSS) vulnerability in Zoho…
• CVE-2018-12997Incorrect Access Control in FailOverHelperServlet in Zoho Ma…7.5
• CVE-2018-12998A reflected Cross-site scripting (XSS) vulnerability in Zoho…6.1
• CVE-2018-1300Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-13000An XSS issue was discovered in Advanced Electron Forum (AEF)…
• CVE-2018-13001An XSS issue was discovered in Sandoba CP:Shop v2016.1. The …
• CVE-2018-13002An XSS issue was discovered in Inhaltsprojekte in Weblicatio…
• CVE-2018-13003An issue was discovered in OpenTSDB 2.3.0. There is XSS in p…
• CVE-2018-13005An issue was discovered in MP4Box in GPAC 0.7.1. The functio…