$ cve CVE-2014-3996 JSON

CVE-2014-3996 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 38.4% (pctl 99)

Patch early

A public exploit exists.

Description

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	38.43% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2014-12-05
Last modified	2026-06-17

Affected (3)

Vendor	Product
manageengine	desktop central
manageengine	it360
manageengine	password manager pro

Public exploits

Source	Title	Date
exploit-db	ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)	2014-08-25

References

→ the Explorer · watch your stack · NVD