Zohocorp ManageEngine products are vulnerable to an authenticated SQL injection that allows an attacker who has valid credentials to read, modify, delete, or otherwise corrupt data stored in the database. The flaw does not grant arbitrary code execution, but it can reveal sensitive information or undermine the integrity of the stored data.

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are affected.

The CVSS score of 8.8 classifies this flaw as high severity. Exploitation requires legitimate authentication, so the most significant risk comes from users with valid access or compromised credentials. The EPSS score of 3% indicates that, while the probability of exploitation is small, it is not negligible. The vulnerability is not listed in the CISA KEV catalog. With elevated privileges, an attacker could breach database confidentiality and integrity, potentially leading to data loss or service disruption.