How severe is CVE-2014-8499?

CVE-2014-8499 has a CVSS 2.0 base score of 6.5, rated medium severity.

Is CVE-2014-8499 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 34% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-8499?

CVE-2014-8499 primarily affects Manageengine Password Manager Pro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-8499?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2014-8499 published?

CVE-2014-8499 was published on 2014-11-17 and last updated on 2026-06-17.

CVE-2014-8499

CVE-2014-8499 is a medium-severity vulnerability in Manageengine Password Manager Pro with a CVSS 2.0 base score of 6.5. Its EPSS exploit-prediction score of 34% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-89.

Key facts

Severity: Medium (CVSS 2.0 base score 6.5)
EPSS exploit prediction: 34% (98th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-89
Affected product: Manageengine Password Manager Pro
Published: 2014-11-17
Last modified: 2026-06-17

Description

Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.

Frequently asked questions

What is CVE-2014-8499?: Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.
How severe is CVE-2014-8499?: CVE-2014-8499 has a CVSS 2.0 base score of 6.5, rated medium severity.
Is CVE-2014-8499 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 34% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-8499?: CVE-2014-8499 primarily affects Manageengine Password Manager Pro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-8499?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2014-8499 published?: CVE-2014-8499 was published on 2014-11-17 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:manageengine:password_manager_pro:*:build_7104:*:*:*:*:*:*
cpe:2.3:a:manageengine:password_manager_pro:*:build_7104:*:*:managed_service_providers:*:*:*

More vulnerabilities in Manageengine Password Manager Pro

CVE-2014-3996 — High (CVSS 7.5): SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop…
CVE-2014-9372 — Medium (CVSS 6.4): Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP)…
CVE-2009-4387 — Medium (CVSS 4.3): The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro…

All CVEs affecting Manageengine Password Manager Pro →

Other CWE-89 (SQL Injection) vulnerabilities

CVE-2026-54350 — Critical (CVSS 10.0): Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase…
CVE-2026-8054 — Critical (CVSS 10.0): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints…
CVE-2026-42287 — Critical (CVSS 10.0): Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and…
CVE-2026-3325 — Critical (CVSS 10.0): SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the…
CVE-2025-10878 — Critical (CVSS 10.0): A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26.…
CVE-2025-57792 — Critical (CVSS 10.0): Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of…

Browse all CWE-89 (SQL Injection) vulnerabilities →