CVE-2020-35765

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.manageengine.comVendor Advisory
https://www.manageengine.com/products/applications_manager/issues.html#v15000Release Notes, Vendor Advisory
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-35765.htmlVendor Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.manageengine.comVendor Advisory
https://www.manageengine.com/products/applications_manager/issues.html#v15000Release Notes, Vendor Advisory
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-35765.htmlVendor Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02Exploit, Third Party Advisory

Timeline

Published: Feb 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-357667.8The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkey CVE-2020-357699.8miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.CVE-2020-35777.4A vulnerability in the ingress packet processing path of Cisco Firepower Threat Defense (FTD) Software for interfaces that are configured ei CVE-2020-357738.8The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.CVE-2020-357745.4server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS CVE-2020-357759.8CITSmart before 9.1.2.23 allows LDAP Injection.CVE-2020-357766.5A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash CVE-2020-357778.4NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.CVE-2020-357788.8Certain NETGEAR devices are affected by CSRF. This affects GS716Tv3 before 6.3.1.36 and GS724Tv4 before 6.3.1.36.CVE-2020-357798.6NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.CVE-2020-35786.5A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) S CVE-2020-357806.5NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.