Authenticated SQL Injection Vulnerability in ManageEngine ADAudit Plus by ZohoCorp
CVE-2025-41444

8.3HIGH

Key Information:

Vendor

Manageengine
Status
Adaudit Plus
Vendor
CVE Published:
9 June 2025

What is CVE-2025-41444?

ZohoCorp's ManageEngine ADAudit Plus, specifically versions up to 8510, is susceptible to an authenticated SQL injection vulnerability found within its alerts module. This flaw allows attackers with authenticated access to execute arbitrary SQL queries, potentially leading to unauthorized access and manipulation of sensitive data. Users of affected versions are encouraged to apply necessary patches and review their security protocols to mitigate risk.

Affected Version(s)

ADAudit Plus 0 < 8511

References

https://www.manageengine.com/products/active-directory-au...

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-41444 : Authenticated SQL Injection Vulnerability in ManageEngine ADAudit Plus by ZohoCorp