PT-2025-42878 · Zohocorp · Manageengine Endpoint Central

Published 2025-04-24 · Updated 2025-10-21 · CVE-2025-7473

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior

Description The software is susceptible to XML Injection. The issue affects Zohocorp ManageEngine EndPoint Central.

Recommendations Update to a version later than 11.4.2516.1.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

BDU:2026-00236

CVE-2025-7473

Affected Products

Manageengine Endpoint Central

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-7473 · Security Note
• https://bdu.fstec.ru/vul/2026-00236 · Security Note
• https://manageengine.com/products/desktop-central/parsing-xml-data.html · Vendor Advisory
• https://t.me/cveNotify/139563 · Telegram Post
• https://twitter.com/CVEnew/status/1980593382419275901 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-42878 · Note
• https://t.me/CVEtracker/35388 · Telegram Post