CVE-2021-28382: Zohocorp ManageEngine Key Manager Plus

Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days.

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.

Affected products

• Zohocorp ManageEngine Key Manager Plus: before 6.0 (fixed in 6.0); version 6.0 only

Published 2021-06-07. Last modified 2026-06-17.