CVE-2025-7761CWE-79

Reflected XSS in Lepszy BIP

Medium · published August 14, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.

The vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00447 · 37.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-14T10:01Z
EPSS history
Timeline
  • 14 AUG 10:01Z
    Reflected XSS in Lepszy BIP
    cvelistv5