Stored XSS Vulnerability in Zohocorp ManageEngine Exchange Reporter Plus
CVE-2025-7632

7.3HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Exchange Reporter Plus
Vendor
CVE Published:
11 November 2025

What is CVE-2025-7632?

The ManageEngine Exchange Reporter Plus by Zohocorp is vulnerable to a Stored Cross-Site Scripting (XSS) attack in its Public Folders report feature. This vulnerability allows an attacker to inject malicious scripts that are then stored on the server and executed within users' browsers, potentially compromising user sessions and sensitive data. Affected users should ensure they are running patched versions to mitigate the risk of exploitation.

Affected Version(s)

ManageEngine Exchange Reporter Plus Windows 0 < 5724

References

https://www.manageengine.com/products/exchange-reports/ad...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-7632 : Stored XSS Vulnerability in Zohocorp ManageEngine Exchange Reporter Plus