{"id":"CVE-2018-9163","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-9163","generatedAt":"2026-10-28T19:05:13.861Z","title":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field…","description":"A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.","published":"2018-04-02T12:29:00.000Z","lastModified":"2026-06-17T02:06:11.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["zohocorp/manageengine recovery manager plus"],"epss":{"score":0.04803,"percentile":0.91903,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2018-05-21","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44666,"kind":"exploit","title":"ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/44666","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/44666.txt","file":"exploits/java/webapps/44666.txt","published":"2018-05-21","added":"2018-05-21","updated":"2018-05-22","author":"Ahmet Gurel","type":"webapps","platform":"java","port":null,"verified":false,"codes":["CVE-2018-9163"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"high","text":"A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is medium and EPSS is 4.8%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/103773","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/44666/","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350","tags":["Release Notes"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/103773","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44666/","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350","tags":["Release Notes"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-9163","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}