CVE-2019-16268

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-02-03 · updated 2026-06-17
Weakness: CWE-79

Description

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

Affected products

Zohocorp Manageengine Remote Access Plus: 10.0.259

References

https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/
https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html
https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/
https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html

Get alerted when CVE-2019-16268 or the next vulnerability affects your stack