Manageengine Analytics Plus (Zohocorp) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 81 known versions, newest CVE from 2025-11-11. Vendor: Zohocorp.

CVEs of Manageengine Analytics Plus

• CVE-2025-8324 - CVSS 9.8 (critical), 2025-11-11: Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
• CVE-2025-9428 - CVSS 8.8 (high), 2025-10-21: Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
• CVE-2024-52323 - CVSS 8.1 (high), 2024-11-27: Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive…
• CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
• CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
• CVE-2020-21642 - CVSS 9.8 (critical), 2022-08-15: Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run…
• CVE-2020-21641 - CVSS 7.5 (high), 2022-08-15: Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files,…
• CVE-2019-12133 - CVSS 7.8 (high), 2019-06-18: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its…