CVE-2025-2610

MediumCVSS 5.4/10Last modified Aug 28, 2026

Description

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
MagnusSolution	MagnusBilling	<= 7.3.0

References

https://chocapikk.com/posts/2025/magnusbilling/Exploit, Third Party Advisory
https://github.com/magnussolution/magnusbilling/commit/f0f083c76157e31149ae58342342fb1bf1629e22
https://vulncheck.com/advisories/magnusbilling-alarm-xssThird Party Advisory
https://chocapikk.com/posts/2025/magnusbilling/Exploit, Third Party Advisory

Timeline

Published: Mar 21, 2025
Last modified: Aug 28, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-26119.3The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a s CVE-2025-261257.3An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate pri CVE-2025-261275.0A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbit CVE-2025-26134.4The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scr CVE-2025-261369.8A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.CVE-2025-261377.5Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit this CVE-2025-261386.5Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded file CVE-2025-26146.5An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that CVE-2025-26156.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, CVE-2025-261535.4A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into message CVE-2025-261559.8NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.CVE-2025-261568.8A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attacke