/Vulnerability Library

MagnusBilling Alarm Module - Cross-Site Scripting

CVE-2025-2610
Verified

Description

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling- through 7.3.0.

Severity

High

CVSS Score

7.6

Exploit Probability

1%

Affected Product

magnusbilling

Published Date

May 20, 2025

Template Author

dhiyaneshdk

CVE-2025-2610.yaml
7.6Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
CVE ID:
cve-2025-2610
CWE ID:
cwe-79

References

https://vulncheck.com/advisories/magnusbilling-logs-xsshttps://chocapikk.com/posts/2025/magnusbilling/https://nvd.nist.gov/vuln/detail/CVE-2025-2610

Remediation Steps

Upgrade to MagnusBilling version 7.3.1 or later that properly sanitizes input in the alarm module.