CVE-2022-24681: Zohocorp ManageEngine Adselfservice Plus

Medium severity, CVSS 6.1. EPSS: 3.6% chance of exploitation in the next 30 days.

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

Affected products

• Zohocorp ManageEngine Adselfservice Plus: before 6.1 (fixed in 6.1); version 6.1 only

Published 2022-04-07. Last modified 2026-06-17.