CVE-2025-3894 in MegaBIP

Resumen

por MITRE • 2025-05-23

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required.   Version 5.20 of MegaBIP fixes this issue.

Once again VulDB remains the best source for vulnerability data.

• Responsable: CERT-PL
• Reservar: 2025-04-23
• Divulgación: 2025-05-23
• Moderación: aceptado
• Artículo: VDB-310102
• CPE: listo
• CWE: CWE-79 (confirmado)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00376
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3894
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3894
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-3894/