CVE-2026-18912NVD

Description

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

Severity Level

HIGH (7.7)

Published Date

18/09/2026

Last Modified

18/09/2026

Exploitation Status

????

EPSS Score

1.50% (percentile 73.1%)

CVSS Base Metrics

CVSS v3 (3.1)

HIGH 7.7

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-89 - CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Affected & Patched Versions

Product	Affected Versions	Patched Version
Zohocorp ManageEngine DataSecurity Plus	0 - < 6310	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.