PT-2025-26957 · Manageengine · Zoho Manageengine Exchange Reporter Plus

Ngockhanhc311 · Published 2025-06-26 · Updated 2025-07-01 · CVE-2025-5966

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ManageEngine Exchange Reporter Plus versions 5722 and below

Description: The issue concerns a Stored XSS in the Attachments by filename keyword report. This affects the management of attachments based on filename keywords, potentially allowing malicious scripts to be stored and executed.

Recommendations: For versions 5722 and below, consider disabling the report feature for attachments by filename keyword until a fix is available. Restrict access to the attachments report module to minimize the risk of exploitation. Avoid using the filename keyword feature in the affected report until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-5966

Affected Products

Zoho Manageengine Exchange Reporter Plus

References · 5

• https://manageengine.com/products/exchange-reports/advisory/CVE-2025-5966.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5966 · Security Note
• https://twitter.com/cracbot/status/1940002498778968493 · Twitter Post
• https://twitter.com/threatsbank/status/1938553143048143334 · Twitter Post