CVE-2020-6843

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.

• CWE-79

• http://packetstormsecurity.com/files/156050/ZOHO-ManageEngine-ServiceDeskPlus-11.0-Build-11007-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Jan/32Exploit, Mailing List, Third Party Advisory
• https://sec-consult.com/en/vulnerability-lab/advisories/index.htmlExploit, Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/34Exploit, Mailing List, Third Party Advisory
• https://www.manageengine.com/products/service-desk/readme.html#11010%20-%20SD-83959Vendor Advisory
• http://packetstormsecurity.com/files/156050/ZOHO-ManageEngine-ServiceDeskPlus-11.0-Build-11007-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Jan/32Exploit, Mailing List, Third Party Advisory
• https://sec-consult.com/en/vulnerability-lab/advisories/index.htmlExploit, Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/34Exploit, Mailing List, Third Party Advisory
• https://www.manageengine.com/products/service-desk/readme.html#11010%20-%20SD-83959Vendor Advisory

Published

Jan 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6836grammar-parser.jison in the hot-formula-parser package befor…9.8
• CVE-2020-6838In mruby 2.1.0, there is a use-after-free in hash_values_at …9.8
• CVE-2020-6839In mruby 2.1.0, there is a stack-based buffer overflow in mr…9.8
• CVE-2020-6840In mruby 2.1.0, there is a use-after-free in hash_slice in m…9.8
• CVE-2020-6841D-Link DCH-M225 1.05b01 and earlier devices allow remote att…9.8
• CVE-2020-6842D-Link DCH-M225 1.05b01 and earlier devices allow remote aut…7.2
• CVE-2020-6844In TopManage OLK 2020, login CSRF can be chained with anothe…8.8
• CVE-2020-6845An issue was discovered in TopManage OLK 2020. As there is n…6.1
• CVE-2020-6847OpenTrade through 0.2.0 has a DOM-based XSS vulnerability th…5.4
• CVE-2020-6848Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka…6.1
• CVE-2020-6849The marketo-forms-and-tracking plugin through 1.0.2 for Word…8.8
• CVE-2020-6850Utilities.php in the miniorange-saml-20-single-sign-on plugi…6.1