MP
Product
ManageEngine Password Manager Pro
On CISA KEVExploited in the wildRansomware-linked
26
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 9Medium 6Low 0
Watch
Add ManageEngine Password Manager Pro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-47966 RansomwareIn wildKEV | 9.8 | Jan 18 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 12.1; 12.1; 12.1; 12.1; 12.1; 12.1; +2 more |
| CVE-2022-35405 In wildKEV | 9.8 | Jul 19 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 12.1; 12.1 |
| CVE-2022-47523 | 9.8 | Jan 5 | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection Affected: before 12.2; 12.2 |
| CVE-2022-43672 | 9.8 | Nov 12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to… Affected: before 12.1; 12.1; 12.1; 12.1; 12.1; 12.1 |
| CVE-2022-43671 | 9.8 | Nov 12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection Affected: before 12.1; 12.1; 12.1; 12.1; 12.1; 12.1 |
| CVE-2022-40300 | 9.8 | Sep 16 | Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection… Affected: 4.6; 4.6; 4.7; 4.7; 4.8; 4.8; +34 more |
| CVE-2022-29081 | 9.8 | Apr 28 | Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for… Affected: 10.1; 10.1; 10.2; 10.3; 10.3; 10.3; +18 more |
| CVE-2020-9347 | 9.8 | Mar 16 | Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature Affected: 10.0; 10.0; 10.1; 10.1; 10.1; 10.1; +9 more |
| CVE-2026-14828 | 8.8 | Sep 2 | Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL… Affected: before 13235 |
| CVE-2026-12263 | 8.8 | Aug 13 | Authentication Bypass Affected: before 13232 |
| CVE-2026-11840 | 8.8 | Aug 13 | SQL Injection Affected: before 13232 |
| CVE-2024-5546 | 8.8 | Aug 28 | Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulnerability via a… Affected: 6.0; 6.1; 6.2; 6.4; 6.4; 6.4; +34 more |
| CVE-2020-9346 | 8.8 | Mar 16 | Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role Affected: before 10.4; 10.4; 10.4; 10.4; 10.4 |
| CVE-2026-5785 | 8.1 | Apr 16 | SQL Injection Affected: 8600 through 13230 |
| CVE-2025-11669 | 8.1 | Jan 13 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue… Affected: before 13.2; 13.2; 13.2; 13.2 |
| CVE-2023-2291 | 7.8 | Apr 26 | Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360 Affected: All versions, or not specified |
| CVE-2019-12133 | 7.8 | Jun 18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders Affected: 9.9 |
| CVE-2016-1159 | 6.5 | Mar 9 | In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password history) via a… Affected: 8.3; 8.4; 8.4; 8.4 |
| CVE-2020-27449 | 6.1 | Aug 11 | Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and… Affected: 11.1 |
| CVE-2017-17698 | 6.1 | Dec 15 | Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec Affected: 9.0 before 9.4 |
| CVE-2021-31857 | 5.9 | Jun 16 | In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types Affected: before 11.1; 11.1; 11.1; 11.1; 11.1 |
| CVE-2023-6105 | 5.5 | Nov 15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed Affected: before 12.3 |
| CVE-2021-33617 | 5.3 | Jul 31 | Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a… Affected: before 11.2; 11.2 |
| CVE-2015-5459 | – | Jul 8 | SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users… Affected: through 8.1 |
| CVE-2014-3997 | – | Dec 5 | SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 6.0; +34 more |
| CVE-2014-8498 | – | Nov 17 | SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build… Affected: through 7.1; through 7.1 |
Showing 26