CVE-2019-11448

PoC ×3—

CVSS 3.0

9.8 critical

EPSS

12%p96

Published

Apr 22, 2019 (Apr 22, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.

Vendors: zohocorp
Products: manageengine applications manager
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (12.4%)

In the news0 stories

No ingested article mentions this CVE yet.