First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-9787

MediumCVSS 6.1/10Last modified Sep 30, 2026

Description

Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Zohocorp	ManageEngine Applications Manager	< 177500

References

https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-9787.htmlPatch, Vendor Advisory

Timeline

Published: Dec 18, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-97889.8A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown fu CVE-2025-97899.8A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is some unknown functionality o CVE-2025-97909.8A security flaw has been discovered in SourceCodester Hotel Reservation System 1.0. This affects an unknown part of the file /admin/updateab CVE-2025-97919.8A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. T CVE-2025-97929.8A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of th CVE-2025-97939.8A vulnerability was detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /setting/admin.php CVE-2025-97949.8A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/p CVE-2025-97955.4A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/CVE-2025-97964.1A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesit CVE-2025-97972.4A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of t CVE-2025-97988.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma al CVE-2025-97995.0A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of th

CVE-2025-9787: Medium severity, CVSS 6.1 | Vulnix