CVE-2026-14828

HighCVSS 8.8/10Last modified Sep 8, 2026

Description

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ZohocorpManageEngine Password Manager Pro< 13235
ZohocorpManageEngine PAM360< 8561
ZohocorpManageEngine Access Manager Plus< 4405

References

Timeline

Published
Sep 2, 2026
Last modified
Sep 8, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-148298.2The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict acceCVE-2026-14837.5An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by GabinetCVE-2026-148307.5The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before markingCVE-2026-148315.3The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server siCVE-2026-148325.3The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-numberCVE-2026-148336.8The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the imCVE-2026-148346.5The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subCVE-2026-148356.8The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer scriCVE-2026-148368.1The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code fCVE-2026-148377.8Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged lCVE-2026-148387.4Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital HumCVE-2026-148397.5The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowi
CVE-2026-14828: High severity, CVSS 8.8 | Vulnix