CVE-2025-3834

CWE-89 — SQL Injection3 documents3 sources

Severity

8.1HIGH

EPSS

3.1%

top 13.25%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Adaudit Plus Zohocorp Manageengine Adaudit Plus

Timeline

PublishedMay 14

Description

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDzohocorp/manageengine_adaudit_plus< 8.5+1

▶CVEListV5manageengine/adaudit_plus< 8511

🔴Vulnerability Details

CVEList

SQL Injection↗2025-05-14

▶

GHSA

GHSA-8qhh-qg7r-qg2v: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report↗2025-05-14

▶