CVEvulnerability

CVE-2025-3444

6.5 MEDIUM Published 2025-05-22 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-22
Last modified
2026-06-17
Assigner
0fc0942c-577d-436f-ae8e-945763c79b02
CVSS 3.1 (0fc0942c-577d-436f-ae8e-945763c79b02)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-434

Description

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

Affected configurations

• zohocorp manageengine servicedesk plus msp (<= 14.8) • zohocorp manageengine servicedesk plus msp 14.9 • zohocorp manageengine supportcenter plus (<= 14.8) • zohocorp manageengine supportcenter plus 14.9

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References