CVE-2015-7765
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin"...
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
Exploit likelihood
What each source reports
NVD Score used
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
- Record
CVE-2015-7765- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
- Record
CVE-2015-7765- Updated
- 2026-11-02
EUVDEUVD-2015-7664 No score
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
- Record
EUVD-2015-7664- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hgc7-q3qg-xcgm No score
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin"...
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
- Record
GHSA-hgc7-q3qg-xcgm- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ManageEngine OpManager - Remote Code Execution (Metasploit) | 2015-09-17 |
| Metasploit | ManageEngine OpManager Remote Code Execution | 2015-09-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7765 is a high vulnerability (CVSS 9.0) in Zohocorp Manageengine Opmanager, published October 9, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 67.3%, the 99th percentile. No source names a fixed version.
References
support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability
rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce
seclists.org/fulldisclosure/2015/Sep/66
packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html
exploit-db.com/exploits/38221
nvd.nist.gov/vuln/detail/CVE-2015-7765
github.com/advisories/GHSA-hgc7-q3qg-xcgm