CVE-2026-28756

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources

Severity

4.8MEDIUM

EPSS

0.0%

top 96.39%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Exchange Reporter Plus

Timeline

PublishedApr 3

Latest updateApr 10

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NExploitability: 2.1 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5zohocorp/manageengine_exchange_reporter_plus< 5802

▶NVDzohocorp/manageengine_exchange_reporter_plus< 5.8+1

🔴Vulnerability Details

VulDB

Zoho ManageEngine Exchange Reporter Plus up to 5801 Distribution Groups Report cross site scripting (Nessus ID 305773)↗2026-04-10

▶

CVEList

Stored XSS Vulnerability↗2026-04-03

▶

GHSA

GHSA-4g8c-fcmg-72qf: Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report↗2026-04-03

▶

🕵️Threat Intelligence

Wiz

CVE-2026-28756 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶