MA
Product
manageengine_adaudit_plus
On CISA KEVExploited in the wildRansomware-linked
54
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 10High 38Medium 5Low 1
Watch
Add manageengine_adaudit_plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-47966 RansomwareIn wildKEV | 9.8 | Jan 18 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +14 more |
| CVE-2026-6516 | 10.0 | Jul 23 | Remote Code Execution Affected: before 8606 |
| CVE-2023-48793 | 9.8 | Feb 2 | Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-48792 | 9.8 | Feb 2 | Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +5 more |
| CVE-2022-28219 | 9.8 | Apr 5 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution Affected: through 6.0; 7.0; 7.0; 7.0; 7.0; 7.0; +8 more |
| CVE-2021-42847 | 9.8 | Nov 11 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +1 more |
| CVE-2020-24786 | 9.8 | Aug 31 | An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,… Affected: through 5.1; 6.0; 6.0; 6.0; 6.0; 6.0; +6 more |
| CVE-2020-11532 | 9.8 | May 8 | Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server Affected: before 6.0.3 |
| CVE-2018-10466 | 9.8 | May 29 | Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection Affected: before 5.0.0 |
| CVE-2026-11374 | 9.0 | Jun 23 | Account Takeover via Predictable SSO Ticket Generation Affected: before 8703 |
| CVE-2024-49574 | 8.8 | Nov 18 | SQL Injection Affected: before 8.1; 8.1; 8.1; 8.1; 8.1; 8.1 |
| CVE-2024-36485 | 8.8 | Nov 4 | SQL Injection Affected: before 8.1; 8.1; 8.1; 8.1; 8.1 |
| CVE-2024-5586 | 8.8 | Aug 23 | SQL Injection Affected: through 8.0; 8.1; 8.1; 8.1 |
| CVE-2024-5556 | 8.8 | Aug 23 | SQL Injection Affected: before 8.0 |
| CVE-2024-5490 | 8.8 | Aug 23 | SQL Injection Affected: before 8.0 |
| CVE-2024-36514 | 8.8 | Aug 23 | SQL Injection Affected: before 8.0 |
| CVE-2024-36515 | 8.8 | Aug 23 | SQL Injection Affected: before 8.0 |
| CVE-2024-36516 | 8.8 | Aug 23 | SQL Injection Affected: before 8.0 |
| CVE-2024-36517 | 8.8 | Aug 23 | SQL Injection Affected: before 8.0 |
| CVE-2024-5467 | 8.8 | Aug 23 | SQL Injection Affected: through 8.0; 8.1; 8.1; 8.1 |
| CVE-2024-36034 | 8.8 | Aug 12 | SQL Injection Affected: before 8.0; 8.0; 8.0; 8.0 |
| CVE-2024-36035 | 8.8 | Aug 12 | SQL Injection Affected: before 8.0; 8.0; 8.0; 8.0; 8.0 |
| CVE-2024-5487 | 8.8 | Aug 12 | SQL Injection Affected: before 8.1; 8.1; 8.1 |
| CVE-2024-5527 | 8.8 | Aug 12 | SQL Injection Affected: before 8.1; 8.1; 8.1 |
| CVE-2023-49335 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49334 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49333 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49332 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49331 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-49330 | 8.8 | May 20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2024-0269 | 8.8 | Feb 2 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2024-0253 | 8.8 | Feb 2 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2022-29457 | 8.8 | Apr 18 | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path… Affected: before 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +10 more |
| CVE-2022-24978 | 8.8 | Apr 5 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products Affected: through 6.0; 7.0; 7.0; 7.0; 7.0; 7.0; +8 more |
| CVE-2020-11531 | 8.8 | May 8 | The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request Affected: before 6.0.1 |
| CVE-2025-41444 | 8.3 | Jun 9 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-36528 | 8.3 | Jun 9 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-27709 | 8.3 | Jun 9 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-41407 | 8.3 | May 23 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-36527 | 8.3 | May 23 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-41403 | 8.3 | May 22 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-3836 | 8.3 | May 22 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2025-3834 | 8.1 | May 14 | SQL Injection Affected: before 8.5; 8.5; 8.5; 8.5 |
| CVE-2024-5608 | 8.1 | Oct 24 | SQL Injection Affected: before 8.1; 8.1; 8.1; 8.1; 8.1 |
| CVE-2023-35785 | 8.1 | Aug 28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below,… Affected: before 7.2; 7.2; 7.2; 7.2 |
| CVE-2023-32783 | 7.5 | Aug 7 | The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix Affected: 7.1.1 |
| CVE-2018-19118 | 7.5 | Dec 13 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new… Affected: before 5.1 |
| CVE-2024-21791 | 7.2 | May 22 | SQL Injection in ADAudit Plus Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2024-36037 | 5.5 | May 27 | Insufficient Access Control Vulnerability Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +8 more |
| CVE-2023-6105 | 5.5 | Nov 15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +6 more |