CVE-2026-3880 — Cross-site Scripting in Manageengine Exchange Reporter Plus

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.8MEDIUMNVD
CNA7.3
EPSS
0.0%
top 96.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zohocorp Manageengine Exchange Reporter Plus
Timeline
PublishedApr 3

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-55qr-4rc4-w5vg: Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report↗2026-04-03
▶
CVEList
Stored XSS Vulnerability↗2026-04-03
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-3880 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-3880 — Cross-site Scripting | cvebase