Authenticated SQLi in ManageEngine PAM360/Password Manager Pro Query Report
CVE-2026-5785 Published on April 16, 2026
SQL Injection
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
Vulnerability Analysis
CVE-2026-5785 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2026-5785 has been classified to as a SQL Injection vulnerability or weakness.
Products Associated with CVE-2026-5785
stack.watch emails you whenever new vulnerabilities are published in Zoho Corp Manageengine Pam360 or Zoho Corp Manageengine Password Manager Pro. Just hit a watch button to start following.
Affected Versions
Zohocorp ManageEngine PAM360:- Before 8531 is affected.
- Version 8600, <= 13230 is affected.