---
title: "ManageEngine Exchange Reporter Plus vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/manageengine/exchange-reporter-plus
type: product
description: "ManageEngine Exchange Reporter Plus has 8 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2025-06-26
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# ManageEngine Exchange Reporter Plus vulnerabilities

Vendor: [ManageEngine](https://radicalnotion.ai/vendor/manageengine)

- **Published CVEs:** 8
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 8
- **Average CVSS:** 8.7
- **First CVE:** 2024-02-16
- **Latest CVE:** 2025-06-26
- **Platforms:** windows

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 1 |
| High | 7 |
| Medium | 0 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 5 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 2 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2024 | 5 |
| 2025 | 3 |

## Affected versions

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 5717 | range | 2 |
| \<= 5722 | range | 2 |
| \< 5714 | range | 1 |
| \< 5715 | range | 1 |
| \< 5719 | range | 1 |
| \< 5722 | range | 1 |
| 5717 | patched | 2 |
| 5714 | patched | 1 |
| 5715 | patched | 1 |
| 5719 | patched | 1 |
| 5722 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2025-5966 | Stored XSS | high | 8.1 | No | No | Yes |
| CVE-2025-5366 | Stored XSS | high | 8.1 | No | No | Yes |
| CVE-2025-3835 | Remote Code Execution | critical | 9.6 | No | No | Yes |
| CVE-2024-9459 | SQL Injection | high | 8.8 | No | No | Yes |
| CVE-2024-6204 | SQL injection | high | 8.3 | No | No | Yes |
| CVE-2024-38872 | SQL Injection | high | 8.8 | No | No | Yes |
| CVE-2024-38871 | SQL Injection | high | 8.8 | No | No | Yes |
| CVE-2024-21775 | SQL Injection | high | 8.8 | No | No | Yes |

## Frequently asked questions

### How many CVEs does ManageEngine Exchange Reporter Plus have?

ManageEngine Exchange Reporter Plus has 8 published CVE records since 2024.

### How many ManageEngine Exchange Reporter Plus CVEs are in CISA KEV?

None of ManageEngine Exchange Reporter Plus's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for ManageEngine Exchange Reporter Plus vulnerabilities?

No ManageEngine Exchange Reporter Plus CVEs currently have a tracked public exploit in this dataset.

### Which versions of ManageEngine Exchange Reporter Plus are affected?

11 distinct ManageEngine Exchange Reporter Plus versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in ManageEngine Exchange Reporter Plus CVEs?

ManageEngine Exchange Reporter Plus's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-434 (Unrestricted Upload of File with Dangerous Type).

### How many critical ManageEngine Exchange Reporter Plus vulnerabilities are there?

ManageEngine Exchange Reporter Plus has 1 critical and 7 high-severity CVEs.

### What is the average severity of ManageEngine Exchange Reporter Plus CVEs?

The average CVSS base score across ManageEngine Exchange Reporter Plus's scored CVEs is 8.7.

## Other products from this vendor

- [ADAudit Plus](https://radicalnotion.ai/vendor/manageengine/adaudit-plus) (38 CVEs)
- [Applications Manager](https://radicalnotion.ai/vendor/manageengine/applications-manager) (14 CVEs)
- [ServiceDesk Plus](https://radicalnotion.ai/vendor/manageengine/servicedesk-plus) (14 CVEs)
- [OpManager](https://radicalnotion.ai/vendor/manageengine/opmanager) (7 CVEs)
- [Desktop Central](https://radicalnotion.ai/vendor/manageengine/desktop-central) (6 CVEs)
- [ADSelfService Plus](https://radicalnotion.ai/vendor/manageengine/adselfservice-plus) (5 CVEs)
- [Password Manager Pro](https://radicalnotion.ai/vendor/manageengine/password-manager-pro) (5 CVEs)
- [SupportCenter Plus](https://radicalnotion.ai/vendor/manageengine/supportcenter-plus) (5 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/manageengine/exchange-reporter-plus). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.