CVE-2014-3779: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allo...

Security readout for executives and security teams

This issue affects older Zoho ManageEngine ADSelfService Plus versions before 5.2 Build 5202. A remote attacker could inject script or HTML into a web page parameter, potentially affecting users who view the resulting content. Public sources do not show confirmed active exploitation. Exposure is most likely where ManageEngine ADSelfService Plus versions earlier than 5.2 Build 5202 remain deployed, especially on user-accessible password self-service portals. The structured affected-product fields are incomplete, but the CVE description names the product and version range. Treat this as a moderate legacy application risk. It is not supported by active-exploitation evidence in the supplied sources, but internet-facing identity self-service portals deserve prompt verification and upgrade planning. Mitigation focus: Upgrade ADSelfService Plus to 5.2 Build 5202 or a later supported release.; Check current Zoho/ManageEngine guidance before making production changes.; Restrict external access to the ADSelfService Plus portal where business allows..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.