CVE-2019-16268: Zohocorp ManageEngine Remote Access Plus

Medium severity, CVSS 4.8. EPSS: 1.8% chance of exploitation in the next 30 days.

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

Affected products

• Zohocorp ManageEngine Remote Access Plus: version 10.0.259 only

Published 2021-02-03. Last modified 2026-06-17.