CVE-2025-41403

CWE-89 — SQL Injection3 documents3 sources

Severity

8.3HIGH

EPSS

2.9%

top 13.57%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Adaudit Plus Zohocorp Manageengine Adaudit Plus

Timeline

PublishedMay 22

Description

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LExploitability: 2.8 | Impact: 5.5

Affected Packages2 packages

▶NVDzohocorp/manageengine_adaudit_plus< 8.5+1

▶CVEListV5manageengine/adaudit_plus< 8511

🔴Vulnerability Details

GHSA

GHSA-x7r7-9j4g-5qrp: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data↗2025-05-22

▶

CVEList

SQL Injection↗2025-05-22

▶