What’s Vulnerable › Vulnerabilities

CVE-2022-40300

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 99.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-16 · updated 2026-06-17
• Weakness: CWE-89

Description

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.

Affected products

• Zohocorp ManageEngine Access Manager Plus: 4.0-build4000, 4.1-build4100, 4.1-build4101, 4.2-build4200, 4.2-build4201, 4.2-build4202 (+6)
• Zohocorp ManageEngine PAM360: 4.0, 4.0-build4001, 4.0-build4002, 4.1, 4.1-build4100, 4.1-build4101 (+27)
• Zohocorp ManageEngine Password Manager Pro: 4.6-build4600, 4.7-build4700, 4.8-build4803, 5.0, 5.1, 5.2 (+145)

References

• https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html
• https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html

Get alerted when CVE-2022-40300 or the next vulnerability affects your stack