PT-2026-21502 · Manageengine · Zoho Manageengine Adselfservice Plus

Nguyen Dang Toan · Publicado 2026-02-23 · Atualizado 2026-02-28 · CVE-2026-1367

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions 6522 and below

Description ManageEngine ADSelfService Plus versions 6522 and below are susceptible to an authenticated SQL Injection issue in the search report option. An attacker with valid credentials can inject malicious SQL code into the search input, potentially compromising the underlying database. The vulnerability exists within the search report feature.

Recommendations Versions prior to 6523 are affected.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-1367

Produtos afetados

Zoho Manageengine Adselfservice Plus

Referências · 9

• https://twitter.com/cracbot/status/2027700361277145455 · Publicação no Twitter
• https://twitter.com/CveTodo/status/2025850167996334424 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2025854270356988210 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2025892031063544289 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2025848317255770469 · Publicação no Twitter
• https://t.me/CVEtracker/45481 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1367 · Nota de Segurança
• https://manageengine.com/uk/products/self-service-password/advisory/CVE-2026-1367.html · Nota
• https://twitter.com/cracbot/status/2027338060833448196 · Publicação no Twitter