CVE-2025-41437 | THREATINT

Description

Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.

Reserved 2025-04-21 | Published 2025-06-09 | Updated 2025-06-09 | Assigner Zohocorp

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

Any version before 128566

affected

Credits

Andrey Alekseev (Positive Technologies) finder

References

www.manageengine.com/itom/advisory/cve-2025-41437.html

cve.org (CVE-2025-41437)

nvd.nist.gov (CVE-2025-41437)

Download JSON