CVE-2022-29457

The CVE-2022-29457 issue is an information-disclosure vulnerability affecting Zoho ManageEngine products: ADSelfService Plus (versions before 6121), ADAuditPlus (before 7060), Exchange Reporter Plus (before 5701), and ADManagerPlus (before 7131). The root cause is NTLM hash disclosure during cert...

CVE-2023-35785

CVE-2023-35785 is a TFA bypass vulnerability affecting Zoho ManageEngine Active Directory 360, ADAudit Plus, ADManager Plus, Asset Explorer, Cloud Security Plus, Data Security Plus, Eventlog Analyzer, Exchange Reporter Plus, Log360, Log360 UEBA, M365 Manager/Security Plus, Recovery Manager Plus, ...

CVE-2023-6105

Technical details about CVE-2023-6105 are not publicly provided in the supplied documents; monitor for updates.

CVE-2020-24786

CVE-2020-24786 affects multiple ManageEngine products (Exchange Reporter Plus, AD360, ADSelfService Plus, DataSecurity Plus, RecoverManager Plus, EventLog Analyzer, ADAudit Plus, O365 Manager Plus, Cloud Security Plus, ADManager Plus, Log360) with a remotely accessible Java servlet (com.manageeng...

CVE-2025-3835

CVE-2025-3835 affects Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and earlier, with a Remote Code Execution vulnerability in the Content Search module. Public notes from multiple sources (NVD/Red Hat/Nessus entry) confirm the affected product and version range and describe RCE in t...

CVE-2024-38871

CVE-2024-38871 affects ManageEngine Exchange Reporter Plus; versions 5717 and below are vulnerable to an authenticated SQL injection in the reports module. The root cause is a lack of protection against SQL query structure attacks in that component, enabling an attacker with valid credentials to ...

CVE-2024-38872

CVE-2024-38872 concerns Zohocorp ManageEngine Exchange Reporter Plus, with affected versions 5717 and below. The issue arises in the monitoring module, where the SQL query structure is not properly protected, enabling an authenticated SQL injection vulnerability. Exploitation would require valid ...

CVE-2024-21775

CVE-2024-21775 affects Zoho ManageEngine Exchange Reporter Plus (versions 5714 and below). The vulnerability is an Authenticated SQL injection in the report exporting feature caused by improper handling in the exporting workflow. Impact as described: high confidentiality, integrity, and sometimes...

CVE-2024-6204

Product affected: Zohocorp ManageEngine Exchange Reporter Plus. Vulnerability: SQL Injection in the reports module. Affected versions: before 5715. Root cause / details: SQL injection vulnerability in the reports module (no further technical specifics provided in the cited documents). Impact (as ...

CVE-2023-22624

CVE-2023-22624 affects Zoho ManageEngine Exchange Reporter Plus prior to 5708. The issue is an XML External Entity (XXE) processing flaw in the product’s XML handling, enabling an attacker to abuse XML input to perform XXE attacks. Public references in the connected documents consistently state t...

CVE-2024-9459

CVE-2024-9459 affects Zoho ManageEngine Exchange Reporter Plus up through version 5718 and earlier. The security issue is described as an authenticated SQL Injection in the reports module. The connected sources specifically list the affected software and version range, with remediation guidance r...

CVE-2025-5966

CVE-2025-5966 affects Zohocorp ManageEngine Exchange Reporter Plus versions 5722 and earlier. The vulnerability is a Stored XSS in the Attachments by filename keyword report, enabling script execution when a crafted filename is processed by the report feature. The issue is confirmed across multip...

CVE-2025-5366

CVE-2025-5366 affects Zohocorp ManageEngine Exchange Reporter Plus 5722 and earlier. The flaw is a Stored XSS in the Folder-wise read mails feature (subject is report). The CVSSv3.1 base score is 8.1 (HIGH); attack vector NETWORK, attack complexity LOW, privileges None, user interaction REQUIRED,...

CVE-2025-5347

CVE-2025-5347 affects Zohocorp ManageEngine Exchange Reporter Plus before version 5723. The vulnerability is a Stored Cross-Site Scripting flaw in the reports module, allowing injected scripts to be stored on the server and executed when users view affected reports. According to the connected adv...

CVE-2026-4107

CVE-2026-4107 affects Zohocorp ManageEngine Exchange Reporter Plus, with stored XSS in the Folder Message Count and Size report for versions before 5802. The CVSS v3.1 base score is 7.3 (HIGH) with Network attack vector, Low attack complexity, Privileges Required: Low, User Interaction: Required,...

CVE-2026-28756

CVE-2026-28756 affects ManageEngine Exchange Reporter Plus from Zoho (ManageEngine) versions prior to 5802. The issue is a Stored XSS vulnerability in the Permissions based on Distribution Groups report, allowing an attacker to inject script via the affected report. The CVSS 3.1 base metrics indi...

CVE-2025-7429

CVE-2025-7429 affects ZOHO ManageEngine Exchange Reporter Plus, with a Stored XSS vulnerability in the Mails Deleted or Moved report affecting versions 5723 and below. Connected documents consistently describe a cross-site scripting flaw in the web-based reporting product that could enable an att...

CVE-2026-3880

ManageEngine Exchange Reporter Plus (Zohocorp) versions before 5802 are vulnerable to a Stored XSS flaw in the Public Folder Client Permissions report. The issue allows injected script via the affected report, with CVSSv3.1 metrics indicating a HIGH base score (7.3), remote attack vector, low att...

CVE-2026-27655

Affected product/component: Zohocorp ManageEngine Exchange Reporter Plus (ManageEngine Exchange Reporter Plus) Vulnerability: Stored XSS in the Permissions Based on Mailboxes report. Affected versions: before 5802. Root cause/impact: Stored XSS vulnerability within the specified report, with no f...

CVE-2026-28703

CVE-2026-28703 affects Zohocorp ManageEngine Exchange Reporter Plus prior to version 5802. The vulnerability is a Stored XSS in the Mails Exchanged Between Users report. The provided metrics indicate a CVSS‑3.1 base score of 7.3 (HIGH), with network attack vector, low attack complexity, privilege...

CVE-2026-28754

ManageEngine Exchange Reporter Plus before build 5802 is vulnerable to a Stored XSS in the Distribution Lists report. The CVE entry confirms the issue exists in versions prior to 5802; no explicit remediation is provided in the supplied documents. Related connected sources also reference addition...

CVE-2026-4108

CVE-2026-4108 affects Zohocorp ManageEngine Exchange Reporter Plus pre-5802. The issue is a stored XSS vulnerability within the Non-Owner Mailbox Permission report, allowing an attacker to inject script when a report is generated or viewed that processes user-supplied input. Based on the availabl...

CVE-2025-5343

CVE-2025-5343 concerns ManageEngine Exchange Reporter Plus, affected up to version 5721. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Instant Search feature, allowing an attacker to inject scripts that are stored on the server and executed when other users access the affec...

CVE-2025-7633

CVE-2025-7633 affects ManageEngine Exchange Reporter Plus (ZOHO) versions 5723 and below, with a Stored XSS in the Custom report feature. Connected sources corroborate the issue and indicate potential impact including unauthorized access via XSS, and several advisories recommend upgrading to a ve...

CVE-2025-5342

CVE-2025-5342 affects Zohocorp ManageEngine Exchange Reporter Plus up to version 5721, with a Regular Expression Denial of Service (ReDoS) in the search module. The RedHat/CNA/CIRCL and other feeds corroborate this DoS issue. Impact is described as potential service disruption due to resource exh...

CVE-2025-7632

The CVE-2025-7632 entry relates to ZOHO ManageEngine Exchange Reporter Plus (web-based reporting tool). A stored cross-site scripting (XSS) flaw exists in the Public Folders report for versions 5723 and below, enabling scripts to be stored and potentially executed when other users access the affe...

CVE-2026-3879

Summary: CVE-2026-3879 affects Zohocorp ManageEngine Exchange Reporter Plus (pre-5802). The vulnerability is a Stored XSS in the Equipment Mailbox Details report. The NVD/NVD-derived entries confirm affected software and release version boundary (before 5802). The CVSSv3.1 vector is AV:N/AC:L/PR:...

CVE-2025-7430

Summary: CVE-2025-7430 affects Zohocorp ManageEngine Exchange Reporter Plus. The vulnerability is a Stored XSS in the Folder Message Count and Size report . Affected versions are 5723 and below . The root cause is not explicitly broken out in all sources, but descriptions consistently indicate th...