What’s Vulnerable › Vulnerabilities
CVE-2025-9787: Stored XSS
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-18 · updated 2026-09-30
- Weakness: CWE-79
Description
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.
Affected products
- Zohocorp ManageEngine Applications Manager: from 17.4 before 17.7; 17.3-build173300, 17.3-build173301, 17.3-build173302, 17.3-build173303, 17.3-build173304, 17.7 (+9) — fixed in 17.7
How to fix
Upgrade to a fixed version: Zohocorp ManageEngine Applications Manager 17.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-9787 or the next vulnerability affects your stack