MA
Product
manageengine_adaudit_plus
On CISA KEVExploited in the wildRansomware-linked
54
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 10High 38Medium 5Low 1
Watch
Add manageengine_adaudit_plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-49574 | 8.8 | Nov 18 | Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module Affected: before 8.1; 8.1; 8.1; 8.1; 8.1; 8.1 |
| CVE-2024-36485 | 8.8 | Nov 4 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option Affected: before 8.1; 8.1; 8.1; 8.1; 8.1 |
| CVE-2024-5586 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option Affected: through 8.0; 8.1; 8.1; 8.1 |
| CVE-2024-5556 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module Affected: before 8.0 |
| CVE-2024-5490 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option Affected: before 8.0 |
| CVE-2024-5467 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report Affected: through 8.0; 8.1; 8.1; 8.1 |
| CVE-2024-36517 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module Affected: before 8.0 |
| CVE-2024-36516 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard Affected: before 8.0 |
| CVE-2024-36515 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard Affected: before 8.0 |
| CVE-2024-36514 | 8.8 | Aug 23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option Affected: before 8.0 |
| CVE-2024-5527 | 8.8 | Aug 12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration Affected: before 8.1; 8.1; 8.1 |
| CVE-2024-5487 | 8.8 | Aug 12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option Affected: before 8.1; 8.1; 8.1 |
| CVE-2024-36035 | 8.8 | Aug 12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording Affected: before 8.0; 8.0; 8.0; 8.0; 8.0 |
| CVE-2024-36034 | 8.8 | Aug 12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option Affected: before 8.0; 8.0; 8.0; 8.0 |
| CVE-2023-49335 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49334 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49333 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49332 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49331 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49330 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2024-0269 | 8.8 | Feb 2 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2024-0253 | 8.8 | Feb 2 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2022-29457 | 8.8 | Apr 18 | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path… Affected: before 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +10 more |
| CVE-2022-24978 | 8.8 | Apr 5 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products Affected: through 6.0; 7.0; 7.0; 7.0; 7.0; 7.0; +8 more |
| CVE-2020-11531 | 8.8 | May 8 | The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request Affected: before 6.0.1 |
| CVE-2025-41444 | 8.3 | Jun 9 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-36528 | 8.3 | Jun 9 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-27709 | 8.3 | Jun 9 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-41407 | 8.3 | May 23 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-36527 | 8.3 | May 23 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-41403 | 8.3 | May 22 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-3836 | 8.3 | May 22 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-3834 | 8.1 | May 14 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2024-5608 | 8.1 | Oct 24 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature Affected: before 8.1; 8.1; 8.1; 8.1; 8.1 |
| CVE-2023-35785 | 8.1 | Aug 28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below,… Affected: before 7.2; 7.2; 7.2; 7.2 |
| CVE-2023-32783 | 7.5 | Aug 7 | The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix Affected: 7.1.1 |
| CVE-2018-19118 | 7.5 | Dec 13 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new… Affected: before 5.1 |
| CVE-2024-21791 | 7.2 | May 22 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
Showing 38