T1565Impact
Data Manipulation
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals…
CVEs30
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.7
Reports1
Detections
3 Sigma rules tagged T1565Data ManipulationT15653 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Data Manipulation
30 CVEs, by priority. Each link shows its badge.- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reportsMITRE CTID mapping of the KEV entry · primary impact99.8%Top 0.04%87.6priority
- CVE-2026-32201Microsoft SharePoint Server Improper Input Validation VulnerabilityMicrosoft · SharePoint ServerKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing ApplicationT1565Data ManipulationAI mapping from the description · primary impact43.4%Top 1.3%72.3priority
- CVE-2023-28434MinIO Security Feature Bypass VulnerabilityAI mapping from the description · primary impact7.9%Top 5.3%68.1priority
- CVE-2026-66384JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityJFrog · ArtifactoryKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1565Data ManipulationAI mapping from the description · primary impact0.7%Top 48%67.1priority
- CVE-2015-4902Oracle Java SE Integrity Check VulnerabilityAI mapping from the description · primary impact13.6%Top 3.5%64.9priority
- CVE-2020-8599Trend Micro Apex One and OfficeScan Authentication Bypass VulnerabilityTrend Micro · Apex One and OfficeScanKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1565Data ManipulationAI mapping from the description · primary impact11.9%Top 3.9%64.1priority
- CVE-2025-24993Microsoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity2.2%Top 17%60.0priority
- CVE-2018-8353A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…MITRE CTID mapping of the CVE · follow-on activity67.3%Top 0.7%24.9priority
- CVE-2018-8355A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · follow-on activity67.9%Top 0.68%24.9priority
- CVE-2019-1118A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…MITRE CTID mapping of the CVE · follow-on activity23.6%Top 2.2%24.6priority
- CVE-2020-16874Visual Studio Remote Code Execution VulnerabilityMicrosoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)High · 7.8T1204.002Malicious FileT1574Hijack Execution Flow+5 moreMITRE CTID mapping of the CVE · follow-on activity4.3%Top 8.9%24.4priority
- CVE-2020-1569Microsoft Edge Memory Corruption VulnerabilityMITRE CTID mapping of the CVE · follow-on activity3.0%Top 13%23.6priority
- CVE-2020-1456A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…Microsoft · Microsoft SharePoint Enterprise ServerMedium · 5.4T1059Command and Scripting InterpreterT1036Masquerading+3 moreMITRE CTID mapping of the CVE · follow-on activity2.2%Top 17%21.0priority
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · follow-on activity9.8%Top 4.4%19.8priority
- CVE-2018-8248A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…MITRE CTID mapping of the CVE · follow-on activity21.4%Top 2.4%19.5priority
- CVE-2018-8575A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…MITRE CTID mapping of the CVE · follow-on activity19.5%Top 2.6%19.5priority
- CVE-2018-8110A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · follow-on activity16.9%Top 2.9%19.4priority
- CVE-2018-8111A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · follow-on activity16.9%Top 2.9%19.4priority
- CVE-2020-1495Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Server 2010 Service Pack 2T1566PhishingT1204.002Malicious File+6 moreMITRE CTID mapping of the CVE · follow-on activity4.2%Top 9%18.9priority
- CVE-2020-1109Windows Update Stack Elevation of Privilege VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.0%Top 37%18.0priority
- CVE-2020-1068Microsoft Windows Elevation of Privilege VulnerabilityMITRE CTID mapping of the CVE · primary impact1.0%Top 39%17.7priority
- CVE-2020-1111Windows Clipboard Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809High · 7.8T1136Create AccountT1068Exploitation for Privilege Escalation+3 moreMITRE CTID mapping of the CVE · follow-on activity1.0%Top 39%17.7priority
- CVE-2018-8431An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially…MITRE CTID mapping of the CVE · follow-on activity2.3%Top 17%16.6priority
- CVE-2020-15109Ability to change order address without triggering address validations in solidussolidusio · solidusMedium · 5.3T1133External Remote ServicesT1190Exploit Public-Facing Application+1 moreMITRE CTID mapping of the CVE · follow-on activity1.0%Top 37%16.3priority
- CVE-2019-1031Microsoft Office SharePoint XSS VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016T1059Command and Scripting InterpreterT1036Masquerading+3 moreMITRE CTID mapping of the CVE · follow-on activity1.7%Top 23%15.3priority
- CVE-2019-1423An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in…Microsoft · Windows 10 Version 1903 for 32-bit SystemsT1068Exploitation for Privilege EscalationT1565Data ManipulationMITRE CTID mapping of the CVE · primary impact1.4%Top 27%15.3priority
- CVE-2018-8607A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…MITRE CTID mapping of the CVE · follow-on activity1.6%Top 24%15.2priority
- CVE-2020-0671An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…MITRE CTID mapping of the CVE · follow-on activity1.4%Top 28%15.0priority
- CVE-2020-5225Log injection in SimpleSAMLphpMITRE CTID mapping of the CVE · follow-on activity0.7%Top 49%13.4priority
- CVE-2019-1270An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…MITRE CTID mapping of the CVE · primary impact0.9%Top 40%11.9priority
Linked through a sub-technique
32 more- CVE-2022-27593QNAP Photo Station Externally Controlled Reference VulnerabilityQNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation87.9%Top 0.24%79.3priority
- CVE-2022-27924Synacor Zimbra Collaboration Suite (ZCS) Command Injection VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation93.9%Top 0.16%78.2priority
- CVE-2022-30333RARLAB UnRAR Directory Traversal Vulnerability99.2%Top 0.06%78.2priority
- CVE-2026-104286Fortinet FortiMail Path Traversal VulnerabilityFortinet · FortiMailKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation4.6%Top 8.4%78.2priority
- CVE-2026-20253Splunk Enterprise Missing Authentication for Critical Function VulnerabilitySplunk · EnterpriseKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation96.9%Top 0.11%74.8priority
- CVE-2026-42208BerriAI LiteLLM SQL Injection VulnerabilityBerriAI · LiteLLMKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System+1 more89.4%Top 0.21%74.8priority
- CVE-2026-67279Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityMikroTik · RouterOSKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more2.3%Top 17%74.2priority
- CVE-2020-36193PEAR Archive_Tar Improper Link Resolution VulnerabilityPEAR · Archive_TarKEVHigh · 7.5T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation70.6%Top 0.61%73.1priority
- CVE-2026-20262Cisco Catalyst SD-WAN Manager Directory or Path Traversal VulnerabilityCisco · Catalyst SD-WAN ManagerKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation29.1%Top 1.8%72.2priority
- CVE-2025-0108Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks · PAN-OSKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1055Process Injection+1 more98.1%Top 0.09%69.4priority
- CVE-2024-8956PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass VulnerabilityPTZOptics · PT30X-SDI/NDI CamerasKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1005Data from Local System+1 more58.8%Top 0.9%69.2priority
- CVE-2019-2616Oracle BI Publisher Unauthorized Access VulnerabilityOracle · BI Publisher (Formerly XML Publisher)KEVPublic exploitHigh · 7.2T1190Exploit Public-Facing ApplicationT1213Data from Information Repositories+1 more92.2%Top 0.18%68.0priority
- CVE-2026-20122Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityCisco · Catalyst SD-WAN MangerKEVMedium · 5.4T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation25.8%Top 2%66.4priority
- CVE-2022-41328Fortinet FortiOS Path Traversal VulnerabilityFortinet · FortiOSKEVHigh · 7.1T1574Hijack Execution FlowT1037Boot or Logon Initialization Scripts+2 more · 1 report10.7%Top 4.2%66.0priority
- CVE-2012-0518Oracle Fusion Middleware Unspecified VulnerabilityOracle · Fusion MiddlewareKEVMedium · 4.7T1189Drive-by CompromiseT1565.002Transmitted Data Manipulation4.7%Top 8.2%59.6priority
- CVE-2019-1943Cisco Small Business Series Switches Open Redirect VulnerabilityCisco · Cisco Small Business 300 Series Managed SwitchesPublic exploitMedium · 4.7T1189Drive-by CompromiseT1557Adversary-in-the-Middle+1 more9.7%Top 4.5%27.4priority
- CVE-2019-15972Cisco Unified Communications Manager SQL Injection VulnerabilityCisco · Cisco Unified Communications ManagerPublic exploitMedium · 5.4T1078Valid AccountsT1133External Remote Services+3 more1.6%Top 24%23.9priority
- CVE-2020-3440Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability2.6%Top 15%23.0priority
- CVE-2019-1689Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability1.6%Top 25%20.2priority
- CVE-2020-3309Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite VulnerabilityCisco · Cisco Firepower Threat Defense SoftwareMedium · 6.5T1133External Remote ServicesT1190Exploit Public-Facing Application+2 more1.8%Top 22%20.2priority
- CVE-2019-1863Cisco Integrated Management Controller Privilege Escalation VulnerabilityCisco · Cisco Unified Computing System E-Series Software (UCSE)Medium · 6.5T1078Valid AccountsT1190Exploit Public-Facing Application+2 more1.7%Top 23%20.0priority
- CVE-2018-5459An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X2.7%Top 14%17.2priority
- CVE-2020-11010SQL injection in Tortoise ORMtortoise · tortoise-ormMedium · 6.3T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more1.0%Top 36%17.2priority
- CVE-2019-1942Cisco Identity Services Engine Blind SQL Injection VulnerabilityCisco · Cisco Identity Services Engine SoftwareMedium · 4.3T1078Valid AccountsT1133External Remote Services+3 more1.2%Top 31%16.8priority
- CVE-2019-18234Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…1.9%Top 20%15.9priority
- CVE-2020-5345Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions…Dell · Unisphere for PowerMaxMedium · 6.4T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation0.7%Top 45%15.4priority
- CVE-2019-3786BBR could run arbitrary scripts on deployment VMsCloud Foundry · BOSH Backup and RestoreHigh · 7.7T1005Data from Local SystemT1565.001Stored Data Manipulation0.6%Top 52%14.9priority
- CVE-2019-15974Cisco Managed Services Accelerator Open Redirect VulnerabilityCisco · Cisco Managed Services AcceleratorMedium · 4.7T1189Drive-by CompromiseT1565.002Transmitted Data Manipulation0.8%Top 43%14.7priority
- CVE-2020-3460Cisco Data Center Network Manager Cross-Site Scripting VulnerabilityCisco · Cisco Data Center Network ManagerMedium · 4.7T1185Browser Session HijackingT1565.002Transmitted Data Manipulation0.7%Top 46%14.0priority
- CVE-2019-1836Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Symbolic Link Path Traversal…Cisco · Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI ModeMedium · 5.5T1133External Remote ServicesT1565.001Stored Data Manipulation0.4%Top 62%12.8priority
- CVE-2020-3237Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability0.4%Top 71%10.1priority
- CVE-2020-3476Cisco IOS XE Software Arbitrary File Overwrite Vulnerability0.3%Top 81%6.9priority