CVE-2025-8324

SQL Injection

State: Published
Severity: 9.8 Critical
Published: Nov 11, 2025
Updated: Feb 26, 2026
Reserved: Jul 30, 2025

Description

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Zohocorp

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
ManageEngine Analytics PlusZohocorp	before 6171Affected

References

https://www.manageengine.com/analytics-plus/CVE-2025-8324.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.