CVE-2014-8498

SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.

• CWE-89

• http://osvdb.org/show/osvdb/114483Broken Link
• http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2014/Nov/18Exploit, Mailing List, Third Party Advisory
• http://www.exploit-db.com/exploits/35210Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/71016Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98596VDB Entry
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txtExploit
• http://osvdb.org/show/osvdb/114483Broken Link
• http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2014/Nov/18Exploit, Mailing List, Third Party Advisory
• http://www.exploit-db.com/exploits/35210Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/71016Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98596VDB Entry
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txtExploit

Published

Nov 17, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8491The Grand Flagallery plugin before 4.25 for WordPress allows…
• CVE-2014-8492Multiple cross-site scripting (XSS) vulnerabilities in asset…
• CVE-2014-8493ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote at…
• CVE-2014-8494ESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Ful…
• CVE-2014-8495Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap…
• CVE-2014-8496Digicom DG-5514T ADSL router with firmware 3.2 generates pre…
• CVE-2014-8499Multiple SQL injection vulnerabilities in ManageEngine Passw…
• CVE-2014-8500ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.…
• CVE-2014-8501The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in G…
• CVE-2014-8502Heap-based buffer overflow in the pe_print_edata function in…
• CVE-2014-8503Stack-based buffer overflow in the ihex_scan function in bfd…
• CVE-2014-8504Stack-based buffer overflow in the srec_scan function in bfd…