CVE-2025-27709

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-27715.3BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication oCVE-2025-277105.5Untrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an infCVE-2025-277116.7Incorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User AppCVE-2025-277125.7Improper neutralization for some Intel(R) Neural Compressor software before version v3.4 within Ring 3: User Applications may allow an escalCVE-2025-277137.8Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation ofCVE-2025-277146.3An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code CVE-2025-277152.7Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team adminsCVE-2025-277166.5Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB stCVE-2025-277176.7Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privCVE-2025-277188.8Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage fiCVE-2025-277195.3Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27726.5BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows netwo
CVE-2025-27709: High severity, CVSS 8.3 | Vulnix