Description
Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. Version 5.20 of MegaBIP fixes this issue.
Metrics
CVSS 4.0 4.8/10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Jan Syski | MegaBIP | <= 5.19 |
References
Timeline
- Published
- May 23, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Deferred