{"affected":[{"defaultStatus":"unaffected","product":"DataSecurity Plus","source":"CNA: Zohocorp","vendor":"Zohocorp","versions":[{"lessThan":"6310","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-18912","cwes":["CWE-89"],"description":"Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries.","epss":{"date":"2026-11-10","percentile":0.8636,"score":0.02756},"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: Zohocorp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794380876229,"publishedAt":1789710078381,"references":[{"source":"CNA: Zohocorp","tags":[],"url":"https://www.manageengine.com/data-security/cve-2026-18912.html"}],"remediation":[],"revision":"250b644f35fe43cd4d75ba7c1adf242723f29521ddf5c1ae7f8387970e5032ef","sources":[{"modifiedAt":1794380876229,"name":"CNA: Zohocorp","retrievedAt":1794384522045,"url":"https://www.cve.org/CVERecord?id=CVE-2026-18912"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794384529741,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18912"}],"ssvc":{"assessedAt":1789735665171,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Authenticated SQL injection","updatedAt":1794384529741}