CVE-2026-12574: Server-Side HTML Injection
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.
What is the likely impact of successful exploitation?
Successful server-side HTML/JavaScript injection during analytics PDF generation can disclose local files. The supplied severity vector also rates confidentiality and integrity impact as high, while availability impact is not indicated.
Which deployments should be considered affected?
ManageEngine DDI Central version 6200 and earlier should be considered affected based on the provided information. The data does not state whether the vulnerable functionality is enabled by default.
What can be done while waiting to patch?
The provided information does not list a workaround. Limit low-privileged access to DDI Central and restrict access to analytics PDF-generation functionality where operationally possible, since exploitation requires authenticated low-privileged access.