CVE-2025-7429
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
Risk Assessment
An attacker can store a malicious script that executes in other report users' browsers, potentially leading to session theft or actions on their behalf.
Recommendation
Update ManageEngine Exchange Reporter Plus to a version newer than 5723 and implement input validation and encoding in reports.
Other vulnerabilities in ManageEngine Exchange Reporter Plus
See all- CVE-2026-27655High
A Stored XSS vulnerability in the 'Permissions Based on Mailboxes' report of ManageEngine Exchange Reporter Plus before version 5802 allows an attacker to inject a malicious script that is permanently stored on the server.
- CVE-2026-4108High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
- CVE-2026-4107High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to stored XSS in the Folder Message Count and Size report. An attacker can inject malicious scripts that execute in other users' browsers.
- CVE-2026-3880High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
- CVE-2026-3879High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in the 'Equipment Mailbox Details' report.
- CVE-2026-28703High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
- CVE-2026-28756High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
- CVE-2026-28754High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
- CVE-2025-7633High
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to Stored XSS in the Custom report feature. A malicious script may be stored and executed in the user's browser.
- CVE-2025-7632High
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
Original NVD description (English source)
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS