CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-17283Zoho ManageEngine OpManager - SQL Injection | Zohocorp · Manageengine Opmanager | Public check | – | 66% | 2018-09-21 |
| CVE-2022-40300Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vu… | Zohocorp · Manageengine Password Manager Pro | Likely | – | 99% | 2022-09-16 |
| CVE-2022-29535Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. | Zohocorp · Manageengine Opmanager | Likely | – | 92% | 2022-05-05 |
| CVE-2019-17602An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, thi… | Zohocorp · Manageengine Opmanager | Likely | – | 81% | 2019-10-15 |
| CVE-2015-7387ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query fo… | Zohocorp · Manageengine Eventlog Analyzer | Likely | – | 80% | 2015-09-28 |
| CVE-2021-41288Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. | Zohocorp · Manageengine Opmanager | Likely | – | 80% | 2021-09-30 |
| CVE-2018-17243Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. | Zohocorp · Manageengine Opmanager | Likely | – | 75% | 2018-09-20 |
| CVE-2022-43671Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. | Zohocorp · Manageengine Password Manager Pro | Likely | 9.8 | 75% | 2022-11-12 |
| CVE-2014-7868Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated us… | Zohocorp · Manageengine Opmanager | Likely | – | 73% | 2014-12-04 |
| CVE-2019-12196A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the… | Zohocorp · Manageengine Netflow Analyzer | Likely | – | 69% | 2019-06-05 |
| CVE-2022-43672Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE… | Zohocorp · Manageengine Password Manager Pro | Likely | 9.8 | 68% | 2022-11-12 |
| CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search. | Zohocorp · Manageengine Network Configuration Manager | Likely | – | 64% | 2021-11-11 |
| CVE-2025-3833SQL Injection | ManageEngine · ADSelfService Plus | Likely | 8.1 | 51% | 2025-05-14 |
| CVE-2021-40493Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFai… | Zohocorp · Manageengine Opmanager | Likely | – | 50% | 2021-10-13 |
| CVE-2025-36527SQL Injection | ManageEngine · ADAudit Plus | Likely | 8.3 | 42% | 2025-05-23 |
| CVE-2020-16267Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module. | Zohocorp · Manageengine Applications Manager | Likely | – | 41% | 2020-10-06 |
| CVE-2020-15927Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. | Zohocorp · Manageengine Applications Manager | Likely | – | 41% | 2020-10-06 |
| CVE-2014-7867SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Socia… | Zohocorp · Manageengine Opmanager | Likely | – | 40% | 2014-12-04 |
| CVE-2018-13050A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request. | Zohocorp · Manageengine Applications Manager | Likely | – | 39% | 2018-07-02 |
| CVE-2014-3996SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 900… | Manageengine · It360 | Likely | – | 38% | 2014-12-05 |
| CVE-2022-27908Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module. | Zohocorp · Manageengine Opmanager | Likely | – | 36% | 2022-04-18 |
| CVE-2014-8499Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remo… | Manageengine · Password Manager Pro | Likely | – | 36% | 2014-11-17 |
| CVE-2025-9428SQL Injection | Zohocorp · Analytics Plus | Likely | 8.3 | 29% | 2025-10-21 |
| CVE-2020-35765doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter… | Zohocorp · Manageengine Applications Manager | Likely | – | 27% | 2021-02-05 |
| CVE-2018-20173Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. | Zohocorp · Manageengine Opmanager | Likely | – | 24% | 2018-12-17 |
| CVE-2018-18949Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. | Zohocorp · Manageengine Opmanager | Likely | – | 24% | 2018-11-05 |
| CVE-2024-6748SQL Injection | ManageEngine · OpManager | Likely | 8.3 | 24% | 2024-07-29 |
| CVE-2014-7864Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier… | Zohocorp · Manageengine Opmanager | Likely | – | 23% | 2015-02-04 |
| CVE-2019-11469Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYST… | Zohocorp · Manageengine Applications Manager | Likely | – | 17% | 2019-04-23 |
| CVE-2018-10466Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection. | Zohocorp · Manageengine Adaudit Plus | Likely | – | 17% | 2018-05-29 |
| CVE-2017-16851Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter. | Zohocorp · Manageengine Applications Manager | Likely | – | 17% | 2017-11-16 |
| CVE-2017-16850Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action. | Zohocorp · Manageengine Applications Manager | Likely | – | 17% | 2017-11-16 |
| CVE-2017-16849Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter. | Zohocorp · Manageengine Applications Manager | Likely | – | 17% | 2017-11-16 |
| CVE-2017-16847Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action. | Zohocorp · Manageengine Applications Manager | Likely | – | 17% | 2017-11-16 |
| CVE-2017-16846Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter. | Zohocorp · Manageengine Applications Manager | Likely | – | 17% | 2017-11-16 |
| CVE-2017-16848Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter. | Zohocorp · Manageengine Applications Manager | Likely | – | 15% | 2017-11-16 |
| CVE-2014-3997SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7… | Zohocorp · Manageengine Password Manager Pro | Likely | – | 13% | 2014-12-05 |
| CVE-2014-8498SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build… | Zohocorp · Manageengine Password Manager Pro | Likely | – | 13% | 2014-11-17 |
| CVE-2019-11448An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp… | Zohocorp · Manageengine Applications Manager | Likely | – | 12% | 2019-04-22 |
| CVE-2018-20338Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. | Zohocorp · Manageengine Opmanager | Likely | – | 12% | 2018-12-21 |
| CVE-2019-19649Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet fun… | Zohocorp · Manageengine Applications Manager | Possible | – | 9.5% | 2019-12-11 |
| CVE-2019-11678The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. | Zohocorp · Manageengine Firewall Analyzer | Possible | – | 9.5% | 2019-05-02 |
| CVE-2026-12507Authenticated remote code execution | Zohocorp · AssetExplorer | Possible | 9.1 | 9.4% | 2026-11-12 |
| CVE-2020-27733Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request. | Zohocorp · Manageengine Applications Manager | Possible | – | 8.9% | 2021-01-19 |
| CVE-2020-27995SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter. | Zohocorp · Manageengine Applications Manager | Possible | – | 8.8% | 2020-10-29 |
| CVE-2026-1367SQL Injection | Zohocorp · ManageEngine ADSelfService Plus | Possible | 8.3 | 8.6% | 2026-02-23 |
| CVE-2020-15394The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution. | Zohocorp · Manageengine Applications Manager | Possible | – | 7.9% | 2020-09-25 |
| CVE-2019-15105An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid param… | Zohocorp · Manageengine Applications Manager | Possible | – | 7.8% | 2019-08-16 |
| CVE-2019-15104An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. The… | Zohocorp · Manageengine Applications Manager | Possible | – | 7.8% | 2019-08-16 |
| CVE-2024-36035SQL Injection | ManageEngine · ADAudit Plus | Possible | 8.3 | 7.4% | 2024-08-12 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.