CVE-2026-28703PATCHED

zoho · manageengine exchange reporter plus

Stored XSS Vulnerability

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.

Affected Products

Vendor	Product	Versions
zoho	manageengine exchange reporter plus	0

References

https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-28703.html

Related News (1 articles)

Tier C

VulDB4h ago

CVE-2026-28703 | Zoho ManageEngine Exchange Reporter Plus up to 5801 Mails Exchanged Between Users Report cross site scripting

→ No new info (linked only)

CVSS 3.17.3 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

null

CWECWE-79

PublishedApr 3, 2026

Last enriched4h agov2

Trending Score32

Source articles1

Independent1

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-28756

Stored XSS Vulnerability

Trending: 32

HIGHCVE-2026-4108

Stored XSS Vulnerability

Trending: 32

HIGHCVE-2026-4107

Stored XSS Vulnerability

Trending: 32

HIGHCVE-2026-3880

Stored XSS Vulnerability

Trending: 32

HIGHCVE-2026-3879

Stored XSS Vulnerability

Trending: 32

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Apr 3, 2026

Discovered by ZDM

Apr 3, 2026

Updated: affectedVersions, severity, patchAvailable

Apr 3, 2026

Patch Available

Apr 3, 2026

Version History

Last enriched 4h ago

v2Tier C4h ago

Updated affected versions to 5801, changed severity to MEDIUM, and noted that no exploit is available.

affectedVersionsseveritypatchAvailable

via VulDB

v14h ago

Initial creation