CVE-2025-5966: Zohocorp ManageEngine Exchange Reporter Plus

High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.

Affected products

• Zohocorp ManageEngine Exchange Reporter Plus: before 5.7 (fixed in 5.7); version 5.7 only

Published 2025-06-26. Last modified 2026-06-17.