CVE-2026-12062

HighCVSS 8.8/10Last modified Nov 11, 2026

Description

Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ZohocorpADAudit Plus< 8703

References

Timeline

Published
Nov 11, 2026
Last modified
Nov 11, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1206277.5The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proCVE-2026-1206309.1CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposiCVE-2026-1206317.5CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CCVE-2026-1206326.5CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST CCVE-2026-1206336.1CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the CVE-2026-1206346.5CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. WarningsCVE-2026-1206358.1CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. CVE-2026-1206366.1CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absCVE-2026-1206379.8CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For aCVE-2026-1206386.1CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redireCVE-2026-1206397.2CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in CVE-2026-120647.5When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer an
CVE-2026-12062: High severity, CVSS 8.8 | Vulnix