CVE-2025-9226

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ZohocorpManageEngine OpManager< 128582
ZohocorpManageEngine NetFlow Analyzer< 128582
ZohocorpManageEngine OpUtils< 128582

References

Timeline

Published
Jan 30, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-92276.5Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.CVE-2025-92284.3MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege userCVE-2025-92295.3Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detaiCVE-2025-92309.8Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read andCVE-2025-92315.9Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementaCVE-2025-92325.9Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment vaCVE-2025-92335.4A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manipCVE-2025-92345.4A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. ThCVE-2025-92355.4A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulCVE-2025-92368.8A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuarioCVE-2025-92375.4A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_accCVE-2025-92387.3A vulnerability was determined in Swatadru Exam-Seating-Arrangement up to 97335ccebf95468d92525f4255a2241d2b0b002f. Affected is an unknown f
CVE-2025-9226: Medium severity, CVSS 4.6 | Vulnix