CVE-2026-18912

Full vulnerability record from the local CVENow database.

Description

Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries.

Severity

HIGH

CVSS score

8.1 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

0fc0942c-577d-436f-ae8e-945763c79b02

Published

2026-09-18 06:16:33.250000

Last modified

2026-11-11 08:17:18.580000

View original CVE JSON

{
  "id": "CVE-2026-18912",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
  "published": "2026-09-18T06:16:33.250",
  "lastModified": "2026-11-11T08:17:18.580",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries."
    }
  ],
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "Zohocorp",
          "product": "DataSecurity Plus",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6310",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-18T12:47:45.171505Z",
          "id": "CVE-2026-18912",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.manageengine.com/data-security/cve-2026-18912.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ]
}