PT-2025-22649 · Megabip · Megabip

Kamil Szczurowski + 1 · Published 2025-05-23 · Updated 2025-05-23 · CVE-2025-3894

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MegaBIP versions prior to 5.20

Description The text editor embedded into MegaBIP software does not neutralize user input, allowing Stored XSS attacks on other users. High privileges are required to use the editor.

Recommendations For versions prior to 5.20, update to version 5.20 to resolve the issue. As a temporary workaround, consider restricting access to the text editor to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3894

Affected Products

Megabip

References · 7

• https://megabip.pl/index.php?id=24,145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3894 · Security Note
• https://t.me/cvetracker/24528 · Telegram Post
• https://t.me/cvenotify/123423 · Telegram Post
• https://twitter.com/CVEnew/status/1925879142286864831 · Twitter Post
• https://cert.pl/en/posts/2025/05/CVE-2025-3893 · Note
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note