CVE-2026-28756

MediumCVSS 4.8/10Last modified Jul 24, 2026

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 3, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-287576.7Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalationCVE-2026-287584.4When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password paraCVE-2026-287594.3Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel bCVE-2026-28768.8A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. ThCVE-2026-287608.4The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to plaCVE-2026-287618.5Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a useCVE-2026-287639.1A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000RCVE-2026-287647.8A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). A specially CVE-2026-287667.5A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.CVE-2026-287675.3A specific administrative endpoint notifications is accessible without proper authentication.CVE-2026-287696.5A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SCVE-2026-28778.8A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component
CVE-2026-28756: Medium severity, CVSS 4.8 | Vulnix