MP
Product
ManageEngine Password Manager Pro
On CISA KEVExploited in the wildRansomware-linked
26
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 9Medium 6Low 0
Watch
Add ManageEngine Password Manager Pro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-14828 | 8.8 | Sep 2 | Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL… Affected: before 13235 |
| CVE-2026-12263 | 8.8 | Aug 13 | Authentication Bypass Affected: before 13232 |
| CVE-2026-11840 | 8.8 | Aug 13 | SQL Injection Affected: before 13232 |
| CVE-2024-5546 | 8.8 | Aug 28 | Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulnerability via a… Affected: 6.0; 6.1; 6.2; 6.4; 6.4; 6.4; +34 more |
| CVE-2020-9346 | 8.8 | Mar 16 | Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role Affected: before 10.4; 10.4; 10.4; 10.4; 10.4 |
| CVE-2026-5785 | 8.1 | Apr 16 | SQL Injection Affected: 8600 through 13230 |
| CVE-2025-11669 | 8.1 | Jan 13 | Broken Access Control Affected: before 13221 |
| CVE-2023-2291 | 7.8 | Apr 26 | Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360 Affected: All versions, or not specified |
| CVE-2019-12133 | 7.8 | Jun 18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders Affected: 9.9 |
Showing 9