PT-2025-46335 · Manageengine · Manageengine Analytics Plus

Published 2025-11-11 · Updated 2025-12-21 · CVE-2025-8324

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine Analytics Plus versions 6170 and below

Description ManageEngine Analytics Plus versions 6170 and below are susceptible to an Unauthenticated SQL Injection due to improper filter configuration. This allows an attacker to execute arbitrary SQL queries against the application's backend database without authentication. Malicious SQL payloads can manipulate or extract sensitive data, potentially compromising the application and its database.

Recommendations Versions prior to 6170 should be updated.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-14639

CVE-2025-8324

Affected Products

Manageengine Analytics Plus

References · 16

• https://bdu.fstec.ru/vul/2025-14639 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-8324 · Security Note
• https://twitter.com/Karma_X_Inc/status/1989411312804245891 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/1989217711851721030 · Twitter Post
• https://twitter.com/CVEnew/status/1988241213150122171 · Twitter Post
• https://twitter.com/vFeed_IO/status/1989505131747148131 · Twitter Post
• https://twitter.com/gothburz/status/1988962889839816928 · Twitter Post
• https://twitter.com/CveTodo/status/1988237415136333986 · Twitter Post
• https://twitter.com/CveFindCom/status/1988255483669479579 · Twitter Post
• https://t.me/CVEtracker/37035 · Telegram Post
• https://manageengine.com/analytics-plus/CVE-2025-8324.html · Note
• https://t.me/pentestingnews/70922 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1988285867471868253 · Twitter Post
• https://twitter.com/AnonOzzyDude/status/1989238346238120339 · Twitter Post
• https://twitter.com/Komodosec/status/2002771691739725902 · Twitter Post