CVE-2026-4107

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources

Severity

5.4MEDIUM

EPSS

0.0%

top 95.09%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Exchange Reporter Plus

Timeline

PublishedApr 3

Latest updateApr 10

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NExploitability: 2.1 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5zohocorp/manageengine_exchange_reporter_plus< 5802

▶NVDzohocorp/manageengine_exchange_reporter_plus< 5.8+1

🔴Vulnerability Details

VulDB

Zoho ManageEngine Exchange Reporter Plus up to 5801 Folder Message Report cross site scripting (Nessus ID 305773)↗2026-04-10

▶

GHSA

GHSA-h96r-c882-j4mv: Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report↗2026-04-03

▶

CVEList

Stored XSS Vulnerability↗2026-04-03

▶

🕵️Threat Intelligence

Wiz

CVE-2026-4107 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶