CVE-2022-40300

Deeper analysis

Zoho ManageEngine Password Manager Pro through version 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 contain multiple SQL injection vulnerabilities tracked as CVE-2022-40300. The issues are classified under CWE-89 and carry a CVSS 3.1 score of 9.8 reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated attacker with network access can supply crafted input to trigger the SQL injection flaws, resulting in full compromise of confidentiality, integrity, and availability of the affected password management or privileged access systems. Successful exploitation could allow arbitrary database queries, data exfiltration, or modification of stored credentials and configuration.

Vendor advisories at https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html describe the affected builds and direct administrators to apply the listed updates that resolve the injections. The associated EPSS score rose from lower values after disclosure to a peak of 0.5295 on 2025-12-11 before receding to the current 0.3825, indicating increased exploitation interest well after the original publication date.