CVE-2025-5966

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

8.1HIGH

EPSS

2.3%

top 15.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Exchange Reporter Plus Manageengine Exchange Reporter Plus

Timeline

PublishedJun 26

Description

Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDzohocorp/manageengine_exchange_reporter_plus< 5.7+1

▶CVEListV5manageengine/exchange_reporter_plus5722

🔴Vulnerability Details

GHSA

GHSA-rpjg-wf34-j7pf: Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report↗2025-06-26

▶

CVEList

Stored XSS↗2025-06-26

▶