Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for ADAudit Plus by Zohocorp

    CVE-2026-12062 (GCVE-0-2026-12062)

    Vulnerability from cvelistv5 – Published: 2026-11-11 07:38 – Updated: 2026-11-11 07:38
    VLAI
    Title
    Authenticated SQL Injection
    Summary
    Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-89 - – Improper Neutralization of Special Elements Used in an SQL Command
    Assigner
    Zohocorp CNA
    References
    Impacted products
    Vendor Product Version
    Zohocorp ADAudit Plus Affected: 0 , < 8703 (custom)
        cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ADAudit Plus",
          "vendor": "Zohocorp",
          "versions": [
            {
              "lessThan": "8703",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8703",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eZoho Corporation ManageEngine\u0026nbsp;\u003c/span\u003eADAudit Plus\u003cspan\u003e\u0026nbsp;versions below\u0026nbsp;\u003c/span\u003e8703\u003cspan\u003e\u0026nbsp;are vulnerable\u0026nbsp;\u003c/span\u003eto an authenticated\u0026nbsp;SQL injection vulnerability in ADAudit Plus Reports API.\u003c/p\u003e"
            }
          ],
          "value": "Zoho Corporation ManageEngine\u00a0ADAudit Plus\u00a0versions below\u00a08703\u00a0are vulnerable\u00a0to an authenticated\u00a0SQL injection vulnerability in ADAudit Plus Reports API."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 \u2013 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 \u2013 Improper Neutralization of Special Elements Used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T07:38:57.448Z",
        "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "shortName": "Zohocorp"
      },
      "references": [
        {
          "url": "https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
    "assignerShortName": "Zohocorp",
    "cveId": "CVE-2026-12062",
    "datePublished": "2026-11-11T07:38:57.448Z",
    "dateReserved": "2026-06-12T06:37:10.058Z",
    "dateUpdated": "2026-11-11T07:38:57.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-76981 (GCVE-0-2026-76981)

    Vulnerability from cvelistv5 – Published: 2026-11-11 07:29 – Updated: 2026-11-11 07:29
    VLAI
    Title
    Authenticated Second-Order SQL Injection
    Summary
    Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-89 - – Improper Neutralization of Special Elements Used in an SQL Command
    Assigner
    Zohocorp CNA
    References
    Impacted products
    Vendor Product Version
    Zohocorp ADAudit Plus Affected: 0 , < 8711 (custom)
        cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ADAudit Plus",
          "vendor": "Zohocorp",
          "versions": [
            {
              "lessThan": "8711",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8711",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eZoho Corporation ManageEngine\u0026nbsp;\u003c/span\u003eADAudit Plus\u003cspan\u003e\u0026nbsp;versions below\u0026nbsp;\u003c/span\u003e8711\u003cspan\u003e\u0026nbsp;are vulnerable\u0026nbsp;\u003c/span\u003eto an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.\u003c/p\u003e"
            }
          ],
          "value": "Zoho Corporation ManageEngine\u00a0ADAudit Plus\u00a0versions below\u00a08711\u00a0are vulnerable\u00a0to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 \u2013 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 \u2013 Improper Neutralization of Special Elements Used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T07:29:50.300Z",
        "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "shortName": "Zohocorp"
      },
      "references": [
        {
          "url": "https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated Second-Order SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
    "assignerShortName": "Zohocorp",
    "cveId": "CVE-2026-76981",
    "datePublished": "2026-11-11T07:29:50.300Z",
    "dateReserved": "2026-08-20T06:37:08.876Z",
    "dateUpdated": "2026-11-11T07:29:50.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}