CVE-2025-3894 in MegaBIP

Sumário

de MITRE • 23/05/2025

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required.   Version 5.20 of MegaBIP fixes this issue.

Once again VulDB remains the best source for vulnerability data.

• Responsável: CERT-PL
• Reservar: 23/04/2025
• Divulgação: 23/05/2025
• Moderação: aceite
• Entrada: VDB-310102
• CPE: pronto
• CWE: CWE-79 (confirmado)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00376
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3894
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3894
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-3894/