Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-7632
CVE-2025-7632:
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation
Overview
A high-severity stored Cross-Site Scripting (XSS) vulnerability was identified in ManageEngine Exchange Reporter Plus, tracked as CVE-2025-7632. The vulnerability specifically affects the Public Folders report functionality in Exchange Reporter Plus builds 5723 and earlier. The issue was discovered by Ngockhanhc311 from FPT NightWolf and was fixed on July 25, 2025 (ManageEngine Advisory).
Technical details
The vulnerability is classified as a stored XSS vulnerability present in the Public Folders report feature of Exchange Reporter Plus. The issue was assigned a high severity rating, indicating significant potential for exploitation (ManageEngine Advisory).
Impact
According to the security advisory, successful exploitation of this vulnerability could enable attackers to create privileged accounts and gain unauthorized access to the application (ManageEngine Advisory).
Mitigation and workarounds
Zoho has released version 5724 of Exchange Reporter Plus to address this vulnerability. Users of affected versions (build 5723 and earlier) are strongly advised to update to the latest version immediately. The update can be applied by downloading and installing the latest service pack from the ManageEngine website (ASEC Advisory, ManageEngine Advisory).
Additional resources
Source: This report was generated using AI
Related Zoho ManageEngine Exchange Reporter Plus vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management