Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter.

Published Nov 16, 2017 · Updated Aug 5, 2024 · Assigned by mitre