Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-119682

Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.

CVSS 4.0 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Manageengine
Products
Sharepoint Manager Plus
CVE-2026-119680

Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Manageengine
Products
Sharepoint Manager Plus