Loading story…
A critical unauthenticated SQL injection vulnerability, tracked as CVE-2025-8324 with a CVSS score of 9.8, has been identified in Zoho Analytics Plus (also known as Zohocorp ManageEngine Analytics Plus) versions 6170 and below. This flaw arises from improper filter configuration, allowing remote attackers to exploit the vulnerability without authentication, potentially leading to full data takeover and exposure of sensitive information.
Security advisories emphasize the severity of this issue, highlighting the risk of unauthorized access and manipulation of analytics data. Organizations using affected versions are urged to apply available patches or mitigations immediately to prevent exploitation, as the vulnerability is remotely exploitable and could be leveraged in targeted attacks against enterprise environments relying on Zoho Analytics Plus for business intelligence and reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Security reporting described CVE-2025-8324 as a critical Zoho Analytics Plus flaw with CVSS 9.8, stating it allows unauthenticated SQL injection and potential data takeover. This added technical impact details beyond the initial CVE listing.
CVE-2025-8324 was publicly listed as a SQL injection vulnerability affecting Zoho Analytics Plus. The CVE entry marks the vulnerability's disclosure as a tracked security issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **CVE-2022-35405**, a pre-authentication remote code execution flaw in **Zoho/ManageEngine Password Manager Pro**, could let an internet-based attacker take over the password vault server through its XML-RPC functionality. The issue was tied to insecure deserialization behavior, aligning with broader OWASP guidance that deserialization flaws can allow untrusted data to trigger arbitrary code execution when applications process attacker-controlled objects. After gaining code execution on a vulnerable Password Manager Pro instance, red-team researchers showed they could reverse engineer the product’s server-side cryptography and recover sensitive secrets, including the stored database password, the master key, and plaintext managed credentials. Their analysis of the default PostgreSQL deployment found that the server’s ability to decrypt secrets on behalf of users created a **single point of failure**: once the PMP server was compromised, attackers could extract vaulted credentials and use them to escalate access, potentially reaching **Domain Admin** in enterprise environments.
Jul 24, 2026
ManageEngine has patched a critical unauthenticated remote code execution flaw in **ADAudit Plus** tracked as `CVE-2026-6516`, affecting all builds earlier than **8606**. The vulnerability resides in the product's Agent API and stems from a chain involving an authentication bypass and a path traversal issue, enabling attackers to execute code remotely without credentials. The issue is classified under `CWE-78`, and public reporting lists a severe network-exploitable attack path with high confidentiality and integrity impact. Zoho/ManageEngine assigned the flaw a **CVSS 10.0** score and released a fix in **build 8606**, advising customers to update the ADAudit Plus server as well as affected Windows and Mac agents. The vendor said there was no confirmed exploitation in the wild and no public proof-of-concept at the time of disclosure. The vulnerability was reported by **Linhlt of VCB**.
Jul 24, 2026
A critical SQL injection flaw tracked as **`CVE-2026-12076`** has been disclosed in **Raytha CMS**, with confirmed impact on version **1.5.2**. The vulnerability resides in the platform’s **OData filter parsing pipeline** and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying **PostgreSQL** database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data. The issue has been rated **CVSS 4.0 9.3 (Critical)** and is considered remotely exploitable. **CERT Polska** coordinated disclosure and credited **Arkadiusz Marta** for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
Jun 30, 2026