CVE-2010-3274 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 21% (pctl 97)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 21% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2011-02-17 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| zohocorp | manageengine adselfservice plus |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | ManageEngine ADSelfService Plus 4.4 - 'EmployeeSearch.cc' Multiple Cross-Site Scripting Vulnerabilities | 2011-02-10 |
References
- http://secunia.com/advisories/43241
- http://securityreason.com/securityalert/8089
- http://www.coresecurity.com/content/zoho-manageengine-vulnerabilities
- http://www.osvdb.org/70871
- http://www.osvdb.org/70872
- http://www.securityfocus.com/archive/1/516396/100/0/threaded
- http://www.securityfocus.com/bid/46331
- http://www.vupen.com/english/advisories/2011/0392
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65349
- http://secunia.com/advisories/43241
- http://securityreason.com/securityalert/8089
- http://www.coresecurity.com/content/zoho-manageengine-vulnerabilities
- http://www.osvdb.org/70871
- http://www.osvdb.org/70872
- http://www.securityfocus.com/archive/1/516396/100/0/threaded
- http://www.securityfocus.com/bid/46331
- http://www.vupen.com/english/advisories/2011/0392
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65349
→ the Explorer · watch your stack · NVD