Login Request a demo
Medium severity · published Nov 11, 2025
CVE-2025-7429
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Manageengine Exchange Reporter Plus · Zohocorp
through 5.6; 5.7; 5.7; 5.7; 5.7; 5.7; +19 more · source: NVD
Affected product
ME
Manageengine Exchange Reporter Plus
Zohocorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7429
Vendor Advisory
https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7429.html
More from Manageengine Exchange Reporter Plus
9.8
CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,…
9.6
CVE-2025-3835
Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module
8.8
CVE-2024-9459
Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in reports module
8.8
CVE-2024-38872
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module
8.8
CVE-2024-38871
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module