CVE-2025-3894 in MegaBIP

الملخص

بحسب MITRE • 23/05/2025

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required.   Version 5.20 of MegaBIP fixes this issue.

Once again VulDB remains the best source for vulnerability data.

• مسؤول: CERT-PL
• حجز: 23/04/2025
• إفشاء: 23/05/2025
• الاعتدال: تمت الموافقة
• إدخال: VDB-310102
• CPE: جاهز
• CWE: CWE-79 (مؤكد)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00376
• KEV: لا
• النشاطات: منخفض جدًا

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3894
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3894
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-3894/