Skip to content
BackEsc
Sign in

Zoho (ManageEngine) · weakness class

SQL Injection

64 CVEs

Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
9

Every one of the 64 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vu…CVE-2022-40300Zohocorp · 99% likely

    CWE-89

  2. Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.CVE-2022-29535Zohocorp · 92% likely

    CWE-89

  3. Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.CVE-2022-43671Zohocorp · CVSS 9.8 · 75% likely

    CWE-89

  4. Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE…CVE-2022-43672Zohocorp · CVSS 9.8 · 68% likely

    CWE-89

  5. SQL InjectionCVE-2025-3833ManageEngine · CVSS 8.1 · 51% likely

    CWE-89

  6. SQL InjectionCVE-2025-36527ManageEngine · CVSS 8.3 · 42% likely

    CWE-89

  7. Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.CVE-2022-27908Zohocorp · 36% likely

    CWE-89

  8. SQL InjectionCVE-2025-9428Zohocorp · CVSS 8.3 · 29% likely

    CWE-89

  9. SQL InjectionCVE-2024-6748ManageEngine · CVSS 8.3 · 24% likely

    CWE-89

  10. Authenticated remote code executionCVE-2026-12507Zohocorp · CVSS 9.1 · 9.4% likelycovered by CyberSIXT

    CWE-891 article1 article this week: Zoho fixes eight ManageEngine flaws, including CVE-2026-12591

  11. SQL InjectionCVE-2026-1367Zohocorp · CVSS 8.3 · 8.6% likely

    CWE-89

  12. SQL InjectionCVE-2024-36035ManageEngine · CVSS 8.3 · 7.4% likely

    CWE-89

  13. SQL InjectionCVE-2024-36034ManageEngine · CVSS 8.3 · 7.4% likely

    CWE-89

  14. Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.CVE-2023-48793Zohocorp · CVSS 9.8 · 7.0% likely

    CWE-89

  15. Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.CVE-2023-48792Zohocorp · CVSS 9.8 · 7.0% likely

    CWE-89

  16. SQL InjectionCVE-2025-3836ManageEngine · CVSS 8.3 · 6.1% likely

    CWE-89

  17. SQL InjectionCVE-2024-0269ManageEngine · CVSS 8.3 · 5.4% likely

    CWE-89

  18. SQL InjectionCVE-2024-36517ManageEngine · CVSS 8.3 · 5.3% likely

    CWE-89

  19. SQL InjectionCVE-2024-5586ManageEngine · CVSS 8.3 · 5.2% likely

    CWE-89

  20. Broken Authentication vulnerabilityCVE-2026-86677Zohocorp · CVSS 8.8 · 5.1% likely

    CWE-89

  21. SQL InjectionCVE-2024-21775ManageEngine · CVSS 8.3 · 5.0% likely

    CWE-89

  22. SQL InjectionCVE-2024-0253ManageEngine · CVSS 8.3 · 5.0% likely

    CWE-89

  23. SQL InjectionCVE-2024-5678ManageEngine · CVSS 4.7 · 5.0% likely

    CWE-89

  24. SQL InjectionCVE-2024-5487ManageEngine · CVSS 8.3 · 4.7% likely

    CWE-89

  25. SQL InjectionCVE-2024-5527ManageEngine · CVSS 8.3 · 4.7% likely

    CWE-89

  26. ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilitiesCVE-2016-9488ManageEngine · 4.6% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in