SharePoint Manager Plus vulnerabilities

3 known vulnerabilities in SharePoint Manager Plus from ManageEngine. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.9 High severity

  SharePoint Manager Plus: Missing Authorization

  CVE-2026-119682Oct 30, 2026ManageEngine

  An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration sett

• 8.5 High severity

  SharePoint Manager Plus: Improper Neutralization of Input During Web Page Generation

  CVE-2026-119680Oct 30, 2026ManageEngine

  A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to

• 8.1 High severity

  SharePoint Manager Plus: Improper Restriction of XML External Entity Reference

  CVE-2024-10839Nov 8, 2024ManageEngineEPSS 2.38%

  Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.