CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

• CWE-209

• http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/ricardojoserf/CVE-2021-31159Exploit, Third Party Advisory
• https://www.manageengine.comProduct
• https://www.manageengine.com/products/service-desk-msp/readme.html#10519Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/ricardojoserf/CVE-2021-31159Exploit, Third Party Advisory
• https://www.manageengine.comProduct
• https://www.manageengine.com/products/service-desk-msp/readme.html#10519Release Notes, Vendor Advisory

Published

Jun 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31152Multilaser Router AC1200 V02.03.01.45_pt contains a cross-si…8.8
• CVE-2021-31153please before 0.4 allows a local unprivileged attacker to ga…3.3
• CVE-2021-31154pleaseedit in please before 0.4 uses predictable temporary f…7.8
• CVE-2021-31155Failure to normalize the umask in please before 0.4 allows a…7.8
• CVE-2021-31156Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Bo…7.5
• CVE-2021-31158In the Query Engine in Couchbase Server 6.5.x and 6.6.x thro…6.5
• CVE-2021-3116before_upstream_connection in AuthPlugin in http/proxy/auth.…7.5
• CVE-2021-31160Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows a…7.5
• CVE-2021-31162In the standard library in Rust before 1.52.0, a double free…9.8
• CVE-2021-31164Apache Unomi prior to version 1.5.5 allows CRLF log injectio…7.5
• CVE-2021-31165Windows Container Manager Service Elevation of Privilege Vul…7.8
• CVE-2021-31166HTTP Protocol Stack Remote Code Execution Vulnerability9.8