Cyber Resilience

CVE-2025-3833

High

Published: 14 May 2025

Published
14 May 2025
Modified
30 September 2025
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0513 90.1th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3833 is a high-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior contain an authenticated SQL injection vulnerability in the MFA reports component, tracked as CVE-2025-3833 with a CVSS 3.1 score of 8.1 and classified under CWE-89. The flaw allows network-accessible attackers with low privileges to manipulate database queries without user interaction.

An authenticated attacker can exploit the issue to read or modify sensitive data, achieving high impact on confidentiality and integrity while leaving availability unaffected. Exploitation requires valid credentials but no special conditions beyond network reachability.

The vendor has published an advisory at https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-3833.html that addresses the flaw. EPSS for the CVE rose from lower values to a peak of 0.1023 on 2026-05-20 before receding to the current 0.0513, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zohocorp
manageengine adselfservice plus
6.5 · ≤ 6.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References