The Exploit

Raxis Cybersecurity Insights From the Frontlines

Exploits

CVE-2022-26653 & CVE-2022-26777: ManageEngine Remote Access Plus Guest User Insecure Direct Object References
ByRaxis Research Team July 21, 2022July 28, 2025

Raxis lead penetration tester Matt Dunn uncovers two more ManageEngine vulnerabilities (CVE-2022-26653 & CVE-2022-26777).

Read More CVE-2022-26653 & CVE-2022-26777: ManageEngine Remote Access Plus Guest User Insecure Direct Object References
Exploits

CVE-2022-25373: ManageEngine Support Center Plus Stored Cross-Site Scripting (XSS)
ByRaxis Research Team July 6, 2022July 28, 2025

Matt Dunn discovers another ManageEngine Cross-Site Scripting vulnerability, this one in the Support Center Plus application.

Read More CVE-2022-25373: ManageEngine Support Center Plus Stored Cross-Site Scripting (XSS)
Exploits

CVE-2022-25245: ManageEngine Asset Explorer Information Leakage
ByRaxis Research Team June 7, 2022September 5, 2025

Raxis lead penetration tester Matt Dunn discovers an information leakage vulnerability in ManageEngine’s Asset Explorer CVE-2022-25245

Read More CVE-2022-25245: ManageEngine Asset Explorer Information Leakage
Exploits

CVE-2022-24681: ManageEngine AD SelfService Plus Stored Cross-Site Scripting (XSS)
ByRaxis Research Team May 17, 2022July 28, 2025

Raxis’ Matt Dunn continues his prolific discovery of new CSS CVEs. This one affects ManageEngine AD SelfService Plus Stored Cross-Site Scripting.

Read More CVE-2022-24681: ManageEngine AD SelfService Plus Stored Cross-Site Scripting (XSS)
Exploits

ManageEngine Key Manager Plus Cross-Site Scripting Vulnerability (CVE-2021-28382)
ByRaxis Research Team June 11, 2021July 28, 2025

Raxis’ Lead Penetration Tester Matt Dunn discovers another cross-site scripting vulnerability in Zoho’s MangeEngine Key Manager Plus (CVE-2021-28382).

Read More ManageEngine Key Manager Plus Cross-Site Scripting Vulnerability (CVE-2021-28382)
Exploits

Cross-Site Scripting Vulnerability in ManageEngine AD Self Service Plus (CVE-2021-27956)
ByRaxis Research Team May 20, 2021July 26, 2025

Raxis lead penetration tester Matt Dunn has uncovered a new cross-site scripting vulnerability in Manage Engine AD Self Service Plus (CVE-2021-27956). Find out more here.

Read More Cross-Site Scripting Vulnerability in ManageEngine AD Self Service Plus (CVE-2021-27956)