CVE-2020-35765

HIGH 8.8CVE-2020-35765 · Published 05/02/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine applications manager zohocorp	`= 14.9< 14.9`	`14.9`

Description

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do.

References

manageengine.com · Vendor Advisory
manageengine.com/products/applications_manager/issues.html · Release Notes
manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-35765.html · Vendor Advisory
tenable.com/security/research/tra-2021-02 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free