CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

EUVD-2026-82656

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2026-18912

ManageEngine DataSecurity Plus versions prior to 6310 are affected by an authenticated SQL injection vulnerability in the Reports module . An attacker with technician-level credentials can execute arbitrary SQL queries, leading to high confidentiality impact (data exfiltration) with a changed sco...

EUVD-2026-82655

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

CVE-2026-18911

ManageEngine DataSecurity Plus versions prior to 6310 are affected by an agent authentication bypass that allows unenrolled agents to send requests to the product without proper authentication. The vulnerability is scored CVSS 7.5 (High) with a network attack vector, high attack complexity, no re...

PT-2026-95230

Name of the Vulnerable Software and Affected Versions ManageEngine DataSecurity Plus versions prior to 6310 Description An authenticated technician can execute arbitrary SQL queries through the Reports module. This is caused by a SQL injection, which occurs when untrusted data is inserted into a...

CVE-2026-18912: Improper Neutralization of Special Elements used in an SQL Command

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

PT-2026-95229

Name of the Vulnerable Software and Affected Versions ManageEngine DataSecurity Plus versions prior to 6310 Description An agent authentication bypass exists that allows unenrolled agents to send requests without proper authentication. Recommendations Update ManageEngine DataSecurity Plus to...

CVE-2026-18911: Improper Input Validation

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

CVE-2026-2740

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

CVE-2026-2740

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

CVE-2026-2740 Remote Code Execution

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

CVE-2026-2740

This CVE affects Zohocorp ManageEngine ADSelfService Plus (before 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313). Root cause: a bug in a third‑party dependency leading to Authenticated Remote Code Execution on agent machines. Affected products expose a high impact ...

EUVD-2026-31283

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency...

ZOHO’s various products have command injection vulnerabilities

ZOHO ManageEngine DataSecurity Plus is a product of the American company ZOHO. ZOHO ManageEngine DataSecurity Plus is a sensitive data management solution. ZOHO ManageEngine ADSelfService Plus is an integrated self-service password management and single-sign-on solution for Active Directory and...