Stored XSS Vulnerability in ManageEngine Exchange Reporter Plus by ZohoCorp
CVE-2026-28703

7.3HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Exchange Reporter Plus
Vendor
CVE Published:
3 April 2026

What is CVE-2026-28703?

The vulnerability in ManageEngine Exchange Reporter Plus allows for Stored Cross-Site Scripting (XSS) attacks through Mails Exchanged Between Users reports. This flaw exists in versions prior to 5802, enabling attackers to inject malicious scripts into the application. If exploited, this could allow unauthorized access to sensitive user information and compromise the integrity of user sessions.

Affected Version(s)

ManageEngine Exchange Reporter Plus 0 < 5802

References

https://www.manageengine.com/products/exchange-reports/ad...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

C311
.