CVE-2025-3894 | THREATINT

Description

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. Version 5.20 of MegaBIP fixes this issue.

Reserved 2025-04-23 | Published 2025-05-23 | Updated 2025-05-23 | Assigner CERT-PL

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

Any version

affected

Credits

Kamil Szczurowski finder

Robert Kruczek finder

References

cert.pl/en/posts/2025/05/CVE-2025-3893 third-party-advisory

megabip.pl/index.php?id=24,145 vendor-advisory

www.gov.pl/...twa-dotyczaca-biuletynow-informacji-publicznej government-resource

cve.org (CVE-2025-3894)

nvd.nist.gov (CVE-2025-3894)

Download JSON