Reflected XSS Vulnerability in Zohocorp ManageEngine Products
CVE-2025-41437

4.3MEDIUM

Key Information:

Vendor

Manageengine
Status
Opmanager
Vendor
CVE Published:
9 June 2025

What is CVE-2025-41437?

Several versions of Zohocorp's ManageEngine products, including OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer, and OpUtils, are susceptible to a reflected cross-site scripting (XSS) vulnerability on the login page. This flaw allows attackers to inject malicious scripts, which could compromise user sessions or manipulate web content. Organizations using affected versions should prioritize patching to safeguard against potential exploitation.

Affected Version(s)

OpManager 0 < 128566

References

https://www.manageengine.com/itom/advisory/cve-2025-41437...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrey Alekseev (Positive Technologies)
.
CVE-2025-41437 : Reflected XSS Vulnerability in Zohocorp ManageEngine Products