- Top reward
- $3,000
- Top severity paid
- Not published
- Assets in scope
- 9
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $3,000
- top reward, from $50.
- Report by email
- https://bugbounty.zohocorp.com/bb
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$3,000
Critical │ $ 3000
- Lowest reward
-
$50
Low │ $ 50
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test.
Domains 2
- manageengine.com
- zoho.com
Products and areas 7
- Arattai
- Qntrl
- Site24x7
- TrainerCentral
- Ulaa Browser
- Vani
- Zoho POS
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-3324 | Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration. | High 8.2 | 16 Apr 2026 |
| CVE-2026-27655 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-3879 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-3880 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-4107 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-4108 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-28703 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-28754 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report. | High 7.3 | 3 Apr 2026 |
| CVE-2026-28756 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report. | High 7.3 | 3 Apr 2026 |
| CVE-2025-9435 | Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module | Medium 5.5 | 13 Jan 2026 |
| CVE-2025-11669 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality. | High 8.1 | 13 Jan 2026 |
| CVE-2025-11250 | Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations. | Critical 9.1 | 13 Jan 2026 |
| CVE-2025-9787 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. | Medium 6.1 | 18 Dec 2025 |
| CVE-2025-11670 | Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled. | Medium 6.4 | 15 Dec 2025 |
| CVE-2025-7430 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. | High 7.3 | 11 Nov 2025 |
| CVE-2025-7632 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. | High 7.3 | 11 Nov 2025 |
| CVE-2025-7633 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. | High 7.3 | 11 Nov 2025 |
| CVE-2025-7429 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. | High 7.3 | 11 Nov 2025 |
| CVE-2025-5343 | Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. | Medium 6.3 | 30 Oct 2025 |
| CVE-2025-5347 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. | Medium 6.3 | 30 Oct 2025 |
| CVE-2025-5342 | Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module. | Medium 4.3 | 30 Oct 2025 |
| CVE-2025-11248 | ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token. | Low 3.2 | 27 Oct 2025 |
| CVE-2025-6239 | Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. | Medium 6.5 | 21 Oct 2025 |
| CVE-2025-10020 | Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component. | High 8.5 | 21 Oct 2025 |
| CVE-2025-9428 | Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api. | High 8.3 | 21 Oct 2025 |
| CVE-2025-7473 | Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection. | Medium 5.2 | 21 Oct 2025 |
| CVE-2025-5496 | ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component. | Low 3.3 | 21 Oct 2025 |
| CVE-2025-5494 | ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13. | Low 3.9 | 25 Sep 2025 |
| CVE-2025-27930 | Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor. | Medium 6.4 | 23 Jul 2025 |
| CVE-2025-5366 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report. | High 8.1 | 26 Jun 2025 |
| CVE-2025-5966 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. | High 8.1 | 26 Jun 2025 |
| CVE-2025-41444 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module. | High 8.3 | 9 Jun 2025 |
| CVE-2025-36528 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports. | High 8.3 | 9 Jun 2025 |
| CVE-2025-3835 | Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module. | Critical 9.6 | 9 Jun 2025 |
| CVE-2025-27709 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports. | High 8.3 | 9 Jun 2025 |
| CVE-2025-41407 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report. | High 8.3 | 23 May 2025 |
| CVE-2025-36527 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports. | High 8.3 | 23 May 2025 |
| CVE-2025-41403 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data. | High 8.3 | 22 May 2025 |
| CVE-2025-3444 | Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded. | Medium 6.5 | 22 May 2025 |
| CVE-2025-3836 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report. | High 8.3 | 22 May 2025 |
| CVE-2025-3833 | Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports. | High 8.1 | 14 May 2025 |
| CVE-2025-3834 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report. | High 8.1 | 14 May 2025 |
| CVE-2024-50053 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. | Medium 6.3 | 21 Mar 2025 |
| CVE-2025-1723 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug. | High 8.1 | 3 Mar 2025 |
| CVE-2024-9097 | ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. | Low 3.5 | 5 Feb 2025 |
| CVE-2024-41140 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. | High 8.1 | 29 Jan 2025 |
| CVE-2024-52323 | Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account. | High 8.1 | 27 Nov 2024 |
| CVE-2024-49574 | Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module. | High 8.3 | 18 Nov 2024 |
| CVE-2024-10839 | Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. | High 8.5 | 8 Nov 2024 |
| CVE-2024-24409 | Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. | High 8.8 | 8 Nov 2024 |
| CVE-2024-10203 | Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. | High 7.0 | 7 Nov 2024 |
| CVE-2024-9459 | Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in reports module. | High 8.3 | 5 Nov 2024 |
| CVE-2024-36485 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option. | High 8.3 | 4 Nov 2024 |
| CVE-2024-48878 | Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report. | High 8.3 | 4 Nov 2024 |
| CVE-2024-5608 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature. | High 8.3 | 24 Oct 2024 |
| CVE-2024-38868 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15 | High 7.6 | 30 Aug 2024 |
| CVE-2024-6204 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module. | High 8.3 | 30 Aug 2024 |
| CVE-2024-5546 | Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulnerability via a global search option. | High 8.3 | 28 Aug 2024 |
| CVE-2024-38869 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25. | High 8.3 | 23 Aug 2024 |
| CVE-2024-41150 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800. | Medium 6.3 | 23 Aug 2024 |