Manageengine Adaudit Plus (Zohocorp) - vulnerabilities (CVEs)

53 CVEs, 0 in the last 30 days, 108 known versions, newest CVE from 2026-07-23. Vendor: Zohocorp.

CVEs of Manageengine Adaudit Plus

CVE-2026-6516 - CVSS 10 (critical), 2026-07-23: Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
CVE-2026-11374 - CVSS 9 (critical), 2026-06-23: In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be…
CVE-2025-41444 - CVSS 8.3 (high), 2025-06-09: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.
CVE-2025-36528 - CVSS 8.3 (high), 2025-06-09: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports.
CVE-2025-27709 - CVSS 8.3 (high), 2025-06-09: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.
CVE-2025-41407 - CVSS 8.3 (high), 2025-05-23: Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.
CVE-2025-36527 - CVSS 8.3 (high), 2025-05-23: Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.
CVE-2025-41403 - CVSS 8.3 (high), 2025-05-22: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.
CVE-2025-3836 - CVSS 8.3 (high), 2025-05-22: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.
CVE-2025-3834 - CVSS 8.1 (high), 2025-05-14: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.
CVE-2024-49574 - CVSS 8.8 (high), 2024-11-18: Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.
CVE-2024-36485 - CVSS 8.8 (high), 2024-11-04: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.
CVE-2024-5608 - CVSS 8.3 (high), 2024-10-24: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature.
CVE-2024-5467 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report.
CVE-2024-5586 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option.
CVE-2024-5556 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.
CVE-2024-5490 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option.
CVE-2024-36515 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different…
CVE-2024-36517 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module.
CVE-2024-36516 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different…
CVE-2024-36514 - CVSS 8.8 (high), 2024-08-23: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option.
CVE-2024-5487 - CVSS 8.8 (high), 2024-08-12: Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option.
CVE-2024-5527 - CVSS 8.8 (high), 2024-08-12: Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration.
CVE-2024-36518 - CVSS 8.3 (high), 2024-08-12: Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard.
CVE-2024-36034 - CVSS 8.8 (high), 2024-08-12: Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.
CVE-2024-36035 - CVSS 8.8 (high), 2024-08-12: Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.
CVE-2024-36037 - CVSS 5.5 (medium), 2024-05-27: Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.
CVE-2024-36036 - CVSS 4.2 (medium), 2024-05-27: Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent…
CVE-2024-21791 - CVSS 7.2 (high), 2024-05-22: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.
CVE-2023-49335 - CVSS 8.8 (high), 2024-05-20: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.
CVE-2023-49332 - CVSS 8.8 (high), 2024-05-20: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.
CVE-2023-49331 - CVSS 8.8 (high), 2024-05-20: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.
CVE-2023-49334 - CVSS 8.8 (high), 2024-05-20: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.
CVE-2023-49333 - CVSS 8.8 (high), 2024-05-20: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.
CVE-2023-49330 - CVSS 8.8 (high), 2024-05-20: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.
CVE-2024-0269 - CVSS 8.8 (high), 2024-02-02: ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and…
CVE-2024-0253 - CVSS 8.8 (high), 2024-02-02: ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data.
CVE-2023-48792 - CVSS 9.8 (critical), 2024-02-02: Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
CVE-2023-48793 - CVSS 9.8 (critical), 2024-02-02: Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.
CVE-2023-50785 - CVSS 2.7 (low), 2024-01-25: Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal.
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-35785 - CVSS 8.1 (high), 2023-08-28: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and…
CVE-2023-32783 - CVSS 7.5 (high), 2023-08-07: The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a…
CVE-2023-37308 - CVSS 5.4 (medium), 2023-07-07: Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.
CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
CVE-2022-29457 - CVSS 8.8 (high), 2022-04-18: Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during…
CVE-2022-28219 - CVSS 9.8 (critical), 2022-04-05: Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.
CVE-2022-24978 - CVSS 8.8 (high), 2022-04-05: Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present…
CVE-2021-42847 - CVSS 9.8 (critical), 2021-11-11: Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
CVE-2020-24786 - CVSS 9.8 (critical), 2020-08-31: An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build…
CVE-2020-11531 - CVSS 8.8 (high), 2020-05-08: The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a…
CVE-2020-11532 - CVSS 9.8 (critical), 2020-05-08: Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to…
CVE-2018-19118 - CVSS 7.5 (high), 2018-12-13: Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field…
CVE-2018-10466 - CVSS 9.8 (critical), 2018-05-29: Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.