CVE-2020-16267

HIGH

Zoho ManageEngine Applications Manager <= 14740 - Authenticated SQL Injection via RCA Module

Title source: llm

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module.

Core 3

Core References

Product x_refsource_misc

Vendor Advisory x_refsource_confirm

Vendor Advisory x_refsource_confirm

CVSS v3 8.8

EPSS 0.0232

EPSS Percentile 85.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89

Status published

Products (1)

zohocorp/manageengine_applications_manager 14.7 (7 CPE variants)

Published Oct 06, 2020

Tracked Since Feb 18, 2026