CVE-2018-16965: Zohocorp ManageEngine SupportCenter Plus

Medium severity, CVSS 6.1. EPSS: 2.5% chance of exploitation in the next 30 days.

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.

Affected products

• Zohocorp ManageEngine SupportCenter Plus: before 8.1 (fixed in 8.1)

Published 2018-09-21. Last modified 2026-06-17.