PT-2026-95230 · Manageengine · Datasecurity Plus
CVE-2026-18912
·
Published
2026-09-18
·
Updated
2026-09-18
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ManageEngine DataSecurity Plus versions prior to 6310
Description
An authenticated technician can execute arbitrary SQL queries through the Reports module. This is caused by a SQL injection, which occurs when untrusted data is inserted into a database query, allowing an attacker to manipulate the query structure.
Recommendations
Update ManageEngine DataSecurity Plus to version 6310 or later.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Datasecurity Plus