CVE-2025-7761

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.

The vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-77626.5A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing o CVE-2025-77634.3A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the fil CVE-2025-77649.8A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown functio CVE-2025-77659.8A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is a CVE-2025-77668.0Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to u CVE-2025-77675.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue CVE-2025-77689.3Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative acces CVE-2025-77698.7Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is cal CVE-2025-77708.7Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predicta CVE-2025-77718.7ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the Mm CVE-2025-77726.5The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all vers CVE-2025-77738.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an inte