CVE-2025-5366 - Stored XSS vulnerability in Exchange Reporter Plus

Details

Exchange Reporter Plus was reported to have a security vulnerability in the Folder-wise Read Mails with Subject report. This has been fixed in build 5723, and its release notes can be found here. This has been fixed in build 5723, and its release notes can be found here.

Impact

This vulnerability could allow attackers to create a privileged account and gain access to the application.

What should I do?

Given the severity of this vulnerability, customers are strongly advised to update Exchange Reporter Plus to the latest build immediately by following the steps given below,

1. Download the latest service pack from here.
2. Apply the latest service pack to your existing product installation by following the instructions provided in the above link.

If you have any questions or need assistance updating the product to the latest version, please contact our product support at support@exchangereporterplus.com.

Acknowledgement

This vulnerability was discovered by Ngockhanhc311 from FPT NightWolf.