Skip to content
CVE Tracker
Back

CVE-2016-9488

ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

Critical9.8EPSS 4.6%
Published
Updated
Reserved
Assigned by
certcc

Description

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.

Scores

CVSS scores of CVE-2016-9488, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Critical9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
4.6% · top 8.3% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

  • ManageEngine · Applications Manager

    • affected 12
    • affected 13

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .