Critical severity9.8NVD Advisory· Published Apr 23, 2019· Updated Jun 17, 2026
CVE-2019-11469
CVE-2019-11469
Description
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4>=12,<=14+ 1 more
- (no CPE)range: >=12,<=14
- (no CPE)range: 12 - 14
- cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*Range: >=12.0,<=14.0
- Range: 12 - 14
Patches
Vulnerability mechanics
References
5- packetstormsecurity.com/files/152607/ManageEngine-Applications-Manager-14.0-SQL-Injection-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
- pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.htmlnvdExploitThird Party Advisory
- www.exploit-db.com/exploits/46740nvdExploitThird Party AdvisoryVDB Entry
- www.exploit-db.com/exploits/46740/nvdExploitThird Party AdvisoryVDB Entry
- www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11469.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.