CVE-2014-7864

CVE-2014-7864 describes multiple SQL injection vulnerabilities in the FailOverHelperServlet of ZOHO ManageEngine OpManager versions 8 through 11.5 build 11400 and IT360 version 10.5 and earlier. These flaws allow remote attackers, both authenticated and unauthenticated, to execute arbitrary SQL commands through the customerName or serverRole parameters during a standbyUpdateInCentral operation. With a CVSS score of 7.5, this vulnerability is considered high severity due to its network-based attack vector, low complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit code is publicly available via ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.