Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-36527
CVE-2025-36527:
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation
Overview
A high-severity SQL injection vulnerability (CVE-2025-36527) was identified in Zohocorp ManageEngine ADAudit Plus affecting all versions below build 8511. The vulnerability was discovered and reported by security researcher minhgalaxy, with the fix being released on May 09, 2025 (ManageEngine Advisory).
Technical details
The vulnerability affects an API responsible for exporting ADAudit Plus reports, allowing SQL injection attacks. The severity is rated as HIGH with a CVSS v3.1 base score of 8.3, and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD).
Impact
The vulnerability could enable an authenticated adversary to execute custom queries and gain unauthorized access to database table entries through the vulnerable request (ManageEngine Advisory).
Mitigation and workarounds
Users are advised to update their ADAudit Plus instance to build 8511 using the service pack. This build contains the fix for the SQL injection vulnerability (ManageEngine Advisory).
Community reactions
The vulnerability was part of a larger security update from ManageEngine in May 2025, which addressed multiple SQL injection vulnerabilities across their product suite (ASEC).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management