CVE-2025-7473CWE-91

CVE-2025-7473

Medium · published October 21, 2025

CVSS v3.1
5.2
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.2th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2025-10-21T15:15Z
Affected products (1)
ProductVersionsFixed in
zohocorp/manageengine_endpoint_central≤ 11.4.2516.01—
References (1)
https://www.manageengine.com/products/desktop-central/parsing-xml-data.html · 0fc0942c-577d-436f-ae8e-945763c79b02
EPSS history
Timeline
  • 21 OCT 10:58Z
    XML Injection
    cvelistv5