CVE-2026-12574highCWE-79

CVE-2026-12574: high-severity vulnerability in Zohocorp DDI Central

Server-Side HTML Injection

Published

Follow this CVE+ Monitor DDI Central

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Zohocorp · DDI Central
Related CVEs — Zohocorp DDI Central

In the same product, most dangerous first.

CVE-2026-12269HIGHAuthenticated File Write to RCE via keepalived in DDI CentralEPSS 7.0%CVE-2026-12268HIGHAuthenticated PowerShell Injection leads to RCEEPSS 4.7%CVE-2026-12267HIGHAuthenticated PowerShell Injection in DNS Query Resolution Policy leads to RCEEPSS 3.6%CVE-2026-12264HIGHAuthenticated Arbitrary File WriteEPSS 2.0%CVE-2026-12265HIGHAuthenticated Broken Access ControlEPSS 0.9%CVE-2026-12266HIGHAuthenticated Broken Access ControlEPSS —