ManageEngine Analytics Plus vulnerabilities

3 known vulnerabilities in ManageEngine Analytics Plus from Zoho. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  ManageEngine Analytics Plus: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-8324Nov 11, 2025ZohoEPSS 1.81%

  Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

• 8.1 High severity

  Analytics Plus: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-52323Nov 27, 2024ManageEngineEPSS 1.47%

  Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.

• 9.8 Critical severity

  Zoho ManageEngine Multiple Products Remote Code Execution Exploited

  CVE-2022-47966Jan 18, 2023ZohoEPSS 99.8%

  Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the a