CVE-2025-3894 Details
Description
Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. Version 5.20 of MegaBIP fixes this issue.
A stored cross-site scripting vulnerability has been identified in MegaBIP software versions prior to 5.20. The issue arises from a text editor embedded in the application, which fails to properly sanitize user input. This flaw allows users with high privileges to execute cross-site scripting attacks that are stored and can affect other users.
Users are advised to update to MegaBIP version 5.20, which addresses this vulnerability. During the update, three specific files in the editor/config directory must be replaced with new versions, as the automatic updater does not modify this folder. The old versions of these files can be deleted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 23, 2025CISA-ADP
Assessed May 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jan Syski MegaBIP | <= 5.19 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 23, 2025 | New CVE Received | [email protected] |