Manageengine Pam360 (Zohocorp) - vulnerabilities (CVEs)

18 CVEs, 0 in the last 30 days, 95 known versions, newest CVE from 2026-09-02. Vendor: Zohocorp.

CVEs of Manageengine Pam360

• CVE-2026-14828 - CVSS 8.8 (high), 2026-09-02: Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to…
• CVE-2026-12263 - CVSS 8.8 (high), 2026-08-13: Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due…
• CVE-2026-11840 - CVSS 8.8 (high), 2026-08-13: Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
• CVE-2026-5785 - CVSS 8.1 (high), 2026-04-16: Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL…
• CVE-2025-11669 - CVSS 8.1 (high), 2026-01-13: Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an…
• CVE-2024-5546 - CVSS 8.8 (high), 2024-08-28: Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection…
• CVE-2024-27313 - CVSS 6.3 (medium), 2024-05-29: Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610.
• CVE-2024-27312 - CVSS 8.1 (high), 2024-05-20: Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This…
• CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
• CVE-2023-2291 - CVSS 7.8 (high), 2023-04-26: Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine…
• CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
• CVE-2022-47523 - CVSS 9.8 (critical), 2023-01-05: Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
• CVE-2022-43672 - CVSS 9.8 (critical), 2022-11-12: Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software…
• CVE-2022-43671 - CVSS 9.8 (critical), 2022-11-12: Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.
• CVE-2022-40300 - CVSS 9.8 (critical), 2022-09-16: Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have…
• CVE-2022-35405 - CVSS 9.8 (critical), 2022-07-19: Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects…
• CVE-2022-29081 - CVSS 9.8 (critical), 2022-04-28: Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few…
• CVE-2021-44525 - CVSS 9.8 (critical), 2021-12-20: Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is…