CVE-2026-12370: Improper Neutralization of Special Elements Used in a Template Engine

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...

PT-2026-97280

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.668 ManageEngine NetFlow Analyzer versions prior to 12.8.668 ManageEngine Network Configuration Manager versions prior to 12.8.668 Description Server-Side Template Injection SSTI occurs during...

EUVD-2019-16967

Malware in sbrugna...

EUVD-2009-3874

Malware in sbrugna...

EUVD-2019-16969

Malware in sbrugna...

ManageEngine NetFlow Analyzer 12.5.x < 12.5.657 / 12.6.x < 12.6.002 / 12.6.104 / 12.6.118 Authenticate Bypass

The version of ManageEngine NetFlow Analyzer running on the remote web server 12.5.x prior to 12.5.657, or 12.6.x prior to 12.6.002 / 12.6.104 / 12.6.118. It is, there, affected by an authentication bypass vulnerability. Due to the lack of proper request handling an unauthenticated, remote attack...

ManageEngine NetFlow Analyzer getDNSResolveOption Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine NetFlow Analyzer. Authentication is required to exploit this vulnerability. The specific flaw exists within the getDNSResolveOption function. The issue results from the lack of proper...

PT-2022-23689

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions before 2022-07-27 through 2022-07-28 Zoho ManageEngine OpManager Plus versions before 2022-07-27 through 2022-07-28 Zoho ManageEngine OpManager MSP versions before 2022-07-27 through 2022-07-28 Zoho...

PT-2019-12692

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine NetFlow Analyzer version 12.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands via the DeviceID parameter in the "/client/api/json/v2/nfareports/compareReport" API endpoint. Recommendations...

CVE-2019-12196: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

CVE-2019-8926

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource...

Path traversal

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...

PT-2019-19263

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description An issue exists in the Administration zone of the software. Cross-site scripting XSS is possible in the /netflow/jspui/scheduleConfig.jsp file via several GET...

PT-2019-19264

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description A security issue was found in the software, where a cross-site scripting XSS attack is possible. This occurs in the "/netflow/jspui/userManagementForm.jsp" API endpoin...

PT-2019-19265

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description A security issue was found in the Administration zone of the software, specifically in the /netflow/jspui/selectDevice.jsp file. This issue involves XSS that exists in...

CVE-2019-8929: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype...

CVE-2019-8928: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName...

CVE-2019-8927: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, repschedule, repType, schDesc,...

CVE-2019-8926: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource...

CVE-2019-8925: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...