CVE-2010-3274: Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in Z...

Security readout for executives and security teams

CVE-2010-3274 is a cross-site scripting issue in ZOHO ManageEngine ADSelfService Plus Employee Search Engine. An attacker could cause malicious script or HTML to run through employee search input. The product is identity-adjacent, so exposure matters most where the application is reachable by employees or the internet. Organizations running ZOHO ManageEngine ADSelfService Plus versions before 4.5 Build 4500 may be exposed. Risk is higher if the employee search feature is externally reachable, broadly accessible internally, or used from privileged identity-management sessions. Treat this as a moderate-priority legacy application risk. It is not listed as KEV in the provided data, but ADSelfService Plus supports identity workflows, so exposed outdated deployments should be found and upgraded promptly. Mitigation focus: Inventory ADSelfService Plus deployments and identify any version before 4.5 Build 4500.; Check current ManageEngine guidance for the supported fixed build and upgrade path.; Restrict external access to ADSelfService Plus where business requirements allow..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.