Vulnerability · Published Mar 21, 2025 · Assigned by VulnCheck

CVE-2025-2609MagnusBilling Stored Cross-Site Scripting in Login Logs

High 8.2

In plain English

A high-severity cross-site scripting in MagnusBilling from MagnusSolution. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)1.2%top 32.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

Affected products (as reported)

Vendor	Product	Versions
MagnusSolution	MagnusBilling	0 – through 7.3.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

In plain English

Official description

Affected products (as reported)

References