Stored XSS Vulnerability in Zohocorp ManageEngine Exchange Reporter Plus

CVE-2025-7632

What is CVE-2025-7632?

The ManageEngine Exchange Reporter Plus by Zohocorp is vulnerable to a Stored Cross-Site Scripting (XSS) attack in its Public Folders report feature. This vulnerability allows an attacker to inject malicious scripts that are then stored on the server and executed within users' browsers, potentially compromising user sessions and sensitive data. Affected users should ensure they are running patched versions to mitigate the risk of exploitation.

References