The flaw is a stored cross‑site scripting vulnerability in the Public Folder Client Permissions report of Zohocorp ManageEngine Exchange Reporter Plus. An attacker can embed malicious HTML or JavaScript into the report data. When a user opens the report, the browser renders the content and executes the injected script. Based on the description, it is inferred that the script runs within the victim’s browser context.

All installations of Zohocorp ManageEngine Exchange Reporter Plus with build numbers before 5802 are affected, while versions 5802 and newer are not. No further sub‑version detail is provided.

The CVSS v3.1 base score of 7.3 indicates high severity, the EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation to date. It is inferred that the attack vector is a web interface that accepts input from users. Because stored payloads are delivered to each user who views the report, the potential impact can range from a single user to the entire organization.