Vulnerability · Published Jun 9, 2025 · Assigned by Zohocorp
CVE-2025-3835Remote Code Execution
Critical 9.6
In plain English
A critical-severity unrestricted file upload in Exchange Reporter Plus from ManageEngine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)2.4%top 15.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ManageEngine | Exchange Reporter Plus | 0 – before 5722 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H