CVE-2025-3894CWE-79

Stored XSS in MegaBIP

Medium · published May 23, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required.

Version 5.20 of MegaBIP fixes this issue.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00447 · 37.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-23T10:20Z
EPSS history
Timeline
  • 23 MAY 10:20Z
    Stored XSS in MegaBIP
    cvelistv5