CVE-2025-10020

Published: Oct 21, 2025Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.

Affected (10)

Products: Zohocorp: Manageengine Admanager Plus

Zohocorp

1 product

Manageengine Admanager Plus

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Admanager Plus	Before 8.0
Zohocorp Manageengine Admanager Plus	Version 8.0 8001
Zohocorp Manageengine Admanager Plus	Version 8.0 8002
Zohocorp Manageengine Admanager Plus	Version 8.0 8010
Zohocorp Manageengine Admanager Plus	Version 8.0 8011
Zohocorp Manageengine Admanager Plus	Version 8.0 8012
Zohocorp Manageengine Admanager Plus	Version 8.0 8020
Zohocorp Manageengine Admanager Plus	Version 8.0 8021
Zohocorp Manageengine Admanager Plus	Version 8.0 8022
Zohocorp Manageengine Admanager Plus	Version 8.0 8023

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (1)

https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-10020.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Vendor Advisory

Timeline

No history available yet.