{"id":"CVE-2018-9163","aliases":["EUVD-2018-20760","GHSA-vq83-9rx8-rq3m"],"status":"published","title":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus...","description":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04803,"percentile":0.92011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2018-04-02T12:00:00Z","modified":"2026-06-17T02:06:11Z","exploits":[{"source":"exploitdb","id":"EDB-44666","title":"ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting","type":"webapps","platform":"java","date":"2018-05-21","url":"https://www.exploit-db.com/exploits/44666"}],"products":[{"vendor":"zohocorp","product":"manageengine_recovery_manager_plus"}],"references":[{"url":"https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/103773","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44666/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9163"},{"url":"https://github.com/advisories/GHSA-vq83-9rx8-rq3m"}],"sources":{"cve":[{"id":"CVE-2018-9163","description":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.","status":"published","published":"2018-04-02T12:00:00Z","modified":"2024-08-05T07:17:51.507Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-20760","description":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.","status":"published","published":"2018-04-02T12:00:00Z","modified":"2024-08-05T07:17:51Z","updated_at":"2026-11-03T02:40:00.465176Z"}],"ghsa":[{"id":"GHSA-vq83-9rx8-rq3m","title":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus...","description":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.","status":"published","published":"2022-05-14T01:30:36Z","modified":"2023-02-02T05:04:10Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:51:48.450626Z"}],"nvd":[{"id":"CVE-2018-9163","description":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.","status":"published","published":"2018-04-02T12:29:00.207Z","modified":"2026-06-17T02:06:11.367Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:24.700429Z"}]}}