CVE-2016-9490

ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability

6.1 Medium

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.70%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 6.1

Record: CVE-2016-9490
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability

Record: CVE-2016-9490
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2016-10296 No score

Record: EUVD-2016-10296
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jm36-8m9x-wq28 6.1

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected...

Record: GHSA-jm36-8m9x-wq28
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

manageengine applications manager

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9490 is a medium vulnerability (CVSS 6.1) in Manageengine Applications Manager, published June 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. No source names a fixed version.