CVE-2025-8319

the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter

Medium · published July 29, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.6th percentile
Published
2025-07-29T23:31Z
EPSS history
Timeline
  • 29 JUL 23:31Z
    the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter
    cvelistv5