PT-2025-44413 · Manageengine · Exchange Reporter Plus

Published 2025-05-29 · Updated 2025-11-07 · CVE-2025-5343

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Exchange Reporter Plus versions through 5721

Description The software is susceptible to a Stored Cross Site Scripting issue within the Instant Search functionality. The issue allows for the injection of malicious scripts that are stored on the target server and executed when other users access the affected feature.

Recommendations Update to a version later than 5721.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16436

CVE-2025-5343

Affected Products

Exchange Reporter Plus

References · 6

• https://osv.dev/vulnerability/CVE-2025-5343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5343 · Security Note
• https://manageengine.com/products/exchange-reports/advisory/CVE-2025-5343.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16436 · Security Note
• https://t.me/CVEtracker/36193 · Telegram Post
• https://t.me/cveNotify/142037 · Telegram Post