CVE-2019-11448

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-114496.1I, Librarian 4.10 has XSS via the notes.php notes parameter.CVE-2019-11458.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-114509.8whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.CVE-2019-114517.2whatsns 4.0 allows index.php?inform/add.html qid SQL injection.CVE-2019-114527.2whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.CVE-2019-114546.1Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introd CVE-2019-114558.1A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the cont CVE-2019-114568.8Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.CVE-2019-114578.8Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-pass CVE-2019-114587.5An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary fi CVE-2019-114595.5The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not h CVE-2019-11467.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who succ