Vulnerability record/PUBLISHED/Published Sep 18, 2026 05:41:18 UTC

CVE-2026-18912

Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries.

Base score8.1/ 10

SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredLowPR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityZohocorp

Last updatedNov 11, 2026 07:07:56 UTC

PublishedSep 18, 2026 05:41:18 UTC

ReservedAug 5, 2026 06:00:56 UTC