CVE-2021-20080: Zohocorp ManageEngine ServiceDesk Plus

Medium severity, CVSS 6.1. EPSS: 93.1% chance of exploitation in the next 30 days.

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.

Affected products

• Zohocorp ManageEngine ServiceDesk Plus: version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only; version 9.2 only; version 9.3 only; …

Published 2021-04-09. Last modified 2026-06-17.