CVE-2018-18980

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

• CWE-611

• https://github.com/x-f1v3/ForCve/issues/5Exploit, Third Party Advisory
• https://www.manageengine.com/network-monitoring/help/read-me.htmlVendor Advisory
• https://github.com/x-f1v3/ForCve/issues/5Exploit, Third Party Advisory
• https://www.manageengine.com/network-monitoring/help/read-me.htmlVendor Advisory

Published

Nov 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1897IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11…8.4
• CVE-2018-18975An issue was discovered in the Ascensia Contour NEXT ONE app…
• CVE-2018-18976An issue was discovered in the Ascensia Contour NEXT ONE app…
• CVE-2018-18977An issue was discovered in the Ascensia Contour NEXT ONE app…
• CVE-2018-18978An issue was discovered in the Ascensia Contour NEXT ONE app…
• CVE-2018-18979An issue was discovered in the Ascensia Contour NEXT ONE app…
• CVE-2018-18981In Rockwell Automation FactoryTalk Services Platform 2.90 an…
• CVE-2018-18982NUUO CMS All versions 3.3 and prior the web server applicati…
• CVE-2018-18983VT-Designer Version 2.1.7.31 is vulnerable by the program re…
• CVE-2018-18984Medtronic CareLink and Encore Programmers do not encrypt o…4.6
• CVE-2018-18985Tridium Niagara Enterprise Security 2.3u1, all versions prio…
• CVE-2018-18986LCDS Laquis SCADA prior to version 4.1.0.4150 allows the ope…