Vulnerability · Published Jun 9, 2025 · Assigned by Zohocorp
CVE-2025-41437Reflected XSS
Medium 4.3
In plain English
A medium-severity cross-site scripting in OpManager from ManageEngine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 81.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ManageEngine | OpManager | 0 – before 128566 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N