CVE-2015-5149: Zohocorp ManageEngine SupportCenter Plus

Medium severity, CVSS 5.5. EPSS: 10.4% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.

Affected products

• Zohocorp ManageEngine SupportCenter Plus: version 7.90 only

Published 2015-06-30. Last modified 2026-06-17.