Authenticated SQL Injection in ManageEngine ADAudit Plus by Zohocorp

CVE-2025-36528

What is CVE-2025-36528?

ManageEngine ADAudit Plus, developed by Zohocorp, is affected by an authenticated SQL injection vulnerability found in the Service Account Auditing reports. This flaw poses a risk to users by allowing attackers with valid authentication to manipulate queries, potentially exposing sensitive data or compromising the integrity of the system. Users of versions 8510 and earlier should take immediate action to review their installations and apply necessary updates or mitigations.

References