CVE-2025-7429CWE-79cross-site-scripting

CVE-2025-7429

High ยท published November 11, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

โšก A sneaky Stored XSS vulnerability lurks in ManageEngine Exchange Reporter Plus versions 5723 and below, waiting for a clever attacker! ๐Ÿ’ป It's like a restaurant that allows diners to write reviews without checking for fake names or inappropriate content โ€“ any user can leave a nasty surprise for the next guest! ๐Ÿฝ๏ธ An attacker could exploit this to inject malicious scripts into reports, potentially hijacking user sessions or stealing sensitive information. If an unsuspecting admin views a compromised report, they could be in for a world of trouble โ€“ and their data could be at risk! ๐Ÿ”ฅ

Put simply

It's like a restaurant that allows diners to write reviews without checking for fake names or inappropriate content โ€“ any user can leave a nasty surprise for the next guest! ๐Ÿฝ๏ธ This Stored XSS vulnerability allows an attacker to inject malicious JavaScript into the Mails Deleted or Moved report, which gets executed in the context of any user who views the report without proper sanitization. This could lead to session hijacking or data theft.

What to do

An attacker could exploit this to inject malicious scripts into reports, potentially hijacking user sessions or stealing sensitive information. If an unsuspecting admin views a compromised report, they could be in for a world of trouble โ€“ and their data could be at risk! ๐Ÿ”ฅ Update to version 5724 or later immediately to close this vulnerability. Ensure that all user inputs are properly sanitized to avoid similar issues in the future. Regularly review your software for updates and vulnerabilities! ๐Ÿ›ก๏ธ Youโ€™ve got this! Stay proactive, follow these steps, and youโ€™ll keep your systems secure! ๐Ÿš€

The record
Technical detail
CVSS v3.1
7.3 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00524 ยท 43.6th percentile
Weakness
CWE-79 ยท Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-11T13:15Z
Affected products (25)
ProductVersionsFixed in
zohocorp/manageengine_exchange_reporter_plusโ‰ค 5.6โ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
zohocorp/manageengine_exchange_reporter_plusall versionsโ€”
References (1)
EPSS history
Timeline
  • 11 NOV 07:40Z
    Stored XSS
    cvelistv5