CVE-2026-12574

HighCVSS 8.1/10Last modified Nov 10, 2026

Description

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Zohocorp	DDI Central	< 6201

References

https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1257427.87-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuati CVE-2026-1257436.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon CVE-2026-1257441.2Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-o CVE-2026-1257454.3Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated atta CVE-2026-1257465.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooC CVE-2026-1257475.4ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated us CVE-2026-1257484.3Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticate CVE-2026-1257494.2TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticate CVE-2026-125757.5DVP80ES3 with Improper Resource Shutdown or Release vulnerability.CVE-2026-1257507.1Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets b CVE-2026-1257513.1Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to appl CVE-2026-1257525.0Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whos