8.2highHigh
CVE-2025-2609
Magnussolution Magnusbilling
Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.
Exploitation status
- Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, no account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 8.2 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N- Weakness
- CWE-79
- Assigned by
- disclosure@vulncheck.com
Dates
- Published
- 2025-03-21
- Last modified
- 2026-08-28
- Sources
- NVD
Affected products
- Magnussolution Magnusbilling- 7.3.0
As listed in the NVD configuration data. Not a statement about your estate.