CVE-2025-9428: SQL Injection
Published Oct 21, 2025
·Updated
Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
Affected Software
11 affected components
Zohocorp ManageEngine Analytics Plus<6171
Zohocorp ManageEngine Analytics Plus<6.1
Zohocorp ManageEngine Analytics Plus=6.1-6100
Zohocorp ManageEngine Analytics Plus=6.1-6110
Zohocorp ManageEngine Analytics Plus=6.1-6120
Zohocorp ManageEngine Analytics Plus=6.1-6130
Zohocorp ManageEngine Analytics Plus=6.1-6140
Zohocorp ManageEngine Analytics Plus=6.1-6150
Zohocorp ManageEngine Analytics Plus=6.1-6160
Zohocorp ManageEngine Analytics Plus=6.1-6170
Zohocorp ManageEngine Analytics Plus=6.1-6171
Event History
Oct 21, 2025
CVE Published
via MITRE·11:43 AM
Data Sourced
via MITRE·11:43 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 28, 57989
Event
via FIRST·01:47 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-9428?
CVE-2025-9428 is classified as a high severity vulnerability due to its potential for exploitation through SQL injection.
2
How do I fix CVE-2025-9428?
To mitigate CVE-2025-9428, upgrade your ManageEngine Analytics Plus to version 6172 or later.
3
What types of attacks can CVE-2025-9428 facilitate?
CVE-2025-9428 can facilitate unauthorized data access or manipulation through SQL injection attacks.
4
Who is affected by CVE-2025-9428?
CVE-2025-9428 affects all users of ManageEngine Analytics Plus versions 6171 and prior.
5
Is authentication required to exploit CVE-2025-9428?
Yes, exploitation of CVE-2025-9428 requiresauthentication to access the vulnerable key update API.