What’s Vulnerable › Vulnerabilities

CVE-2025-3444: Local File Inclusion

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-22 · updated 2026-06-17
• Weakness: CWE-434

Description

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

Affected products

• Zohocorp Manageengine Servicedesk Plus Msp: through 14.8; 14.9-14900, 14.9-14910
• Zohocorp Manageengine Supportcenter Plus: through 14.8; 14.9-14900, 14.9-14910

References

• https://www.manageengine.com/products/service-desk-msp/cve-2025-3444.html

Get alerted when CVE-2025-3444 or the next vulnerability affects your stack