CVE-2009-4387: ManageEngine Password Manager Pro

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.

Affected products

• ManageEngine Password Manager Pro: up to and including 6.1; version 4.6 only; version 4.7 only; version 4.8 only; version 5.0 only; version 5.1 only; …
• ManageEngine Password Manager PRO6.1: up to and including -

Published 2009-12-22. Last modified 2026-06-16.