Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Zohocorp | DDI Central | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Nov 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account. | |
| Title | SQL Injection | |
| First Time appeared |
Zohocorp
Zohocorp ddi Central |
|
| Weaknesses | CWE-89 | |
| CPEs | cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Zohocorp
Zohocorp ddi Central |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Zohocorp
Published:
Updated: 2026-11-10T11:16:44.702Z
Reserved: 2026-06-18T05:18:28.398Z
Link: CVE-2026-12572
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses