Stored XSS Vulnerability in ManageEngine Exchange Reporter Plus by Zohocorp

CVE-2026-4107

What is CVE-2026-4107?

ManageEngine Exchange Reporter Plus versions earlier than 5802 are susceptible to a stored Cross-Site Scripting vulnerability. This security flaw allows attackers to inject malicious scripts into the Folder Message Count and Size report, which can be executed in the context of a user's session. Successful exploitation may lead to unauthorized access to sensitive data and the potential manipulation of user sessions.

References