CVE-2025-2609CWE-79cross-site-scripting

CVE-2025-2609

High · published March 22, 2025

CVSS v3.1
8.2
EPSS
1%
Percentile
66.7
In the wild
Unconfirmed
What it is

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01152 · 66.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-22T03:15Z
Affected products (1)
ProductVersionsFixed in
magnussolution/magnusbilling≤ 7.3.0—
References (4)
https://chocapikk.com/posts/2025/magnusbilling/ · [email protected]https://github.com/magnussolution/magnusbilling/commit/f0f083c76157e31149ae58342342fb1bf1629e22 · [email protected]https://vulncheck.com/advisories/magnusbilling-logs-xss · [email protected]https://chocapikk.com/posts/2025/magnusbilling/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 MAR 22:41Z
    MagnusBilling Stored Cross-Site Scripting in Login Logs
    cvelistv5