Vulnerability · Published Feb 16, 2025 · Assigned by VulDB
CVE-2025-1337Eastnets PaymentSafe BIC Search cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in PaymentSafe from Eastnets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.5.27.0 is able to address this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eastnets | PaymentSafe | 2.5.26.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- VDB-295953 | Eastnets PaymentSafe BIC Search cross site scripting vdb-entry, technical-description
- VDB-295953 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- Submit #493686 | Eastnets PaymentSafe 2.5.26.0 Cross Site Scripting third-party-advisory
- https://drive.google.com/file/d/1uTRLoCnOGcXtSpoZO8xyPakhIO4MbCMk/view?usp=sharing broken-link