ManageEngine Application Manager 12 suffers from cross site request forgery, privilege escalation, and cross site scripting vulnerabilities.