CVE-2025-3836

CWE-89 — SQL Injection3 documents3 sources

Severity

8.3HIGH

EPSS

3.2%

top 13.03%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Adaudit Plus Zohocorp Manageengine Adaudit Plus

Timeline

PublishedMay 22

Description

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LExploitability: 2.8 | Impact: 5.5

Affected Packages2 packages

▶NVDzohocorp/manageengine_adaudit_plus< 8.5+1

▶CVEListV5manageengine/adaudit_plus< 8511

🔴Vulnerability Details

CVEList

SQL Injection↗2025-05-22

▶

GHSA

GHSA-4w7r-x646-644r: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report↗2025-05-22

▶