Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.CVE-2026-27655 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.CVE-2026-4108 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.CVE-2026-4107 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.CVE-2026-3880 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.CVE-2026-3879 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.CVE-2026-28703 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.CVE-2026-28756 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.CVE-2026-28754 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.CVE-2025-7633 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.CVE-2025-7632 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.CVE-2025-7430 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.CVE-2025-7429 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.CVE-2025-5347 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.CVE-2025-5343 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.CVE-2025-5342 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 4.3
Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.CVE-2025-5966 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.CVE-2025-5366 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module.CVE-2024-6204 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module.CVE-2024-38872 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 26, 2024Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module.CVE-2024-38871 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Feb 16, 2024Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.CVE-2024-21775 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 17, 2023Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.CVE-2023-22624 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.
- Product
- Manageengine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 31, 2020An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build nuCVE-2020-24786 · Email & office · Zohocorp · reported by MITRECritical 9.8
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.compitstop.manageengine.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.