CVE-2025-7429

Published: Nov 11, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.

Affected (25)

Products: Zohocorp: Manageengine Exchange Reporter Plus

Zohocorp

1 product

Manageengine Exchange Reporter Plus

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Exchange Reporter Plus	Up to 5.6
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5700
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5701
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5702
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5703
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5704
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5705
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5706
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5707
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5708
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5709
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5710
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5711
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5712
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5713
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5714
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5715
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5717
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5718
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5719
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5720
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5721
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5722
Zohocorp Manageengine Exchange Reporter Plus	Version 5.7 5723

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7429.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Vendor Advisory

Timeline

No history available yet.