Stored XSS Vulnerability in ManageEngine Exchange Reporter Plus by Zohocorp
CVE-2026-28754

7.3HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Exchange Reporter Plus
Vendor
CVE Published:
3 April 2026

What is CVE-2026-28754?

ManageEngine Exchange Reporter Plus, versions prior to 5802, contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) in Distribution Lists reports. This flaw could potentially enable attackers to inject malicious scripts into web pages viewed by users, leading to unauthorized access to sensitive information or manipulation of user sessions.

Affected Version(s)

ManageEngine Exchange Reporter Plus 0 < 5802

References

https://www.manageengine.com/products/exchange-reports/ad...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

C311
.