PT-2025-31341 · Bma · Bma

Takkotheboss · Published 2025-07-29 · Updated 2025-08-05 · CVE-2025-8319

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BMA (affected versions not specified)

Description The BMA login interface allows arbitrary JavaScript or HTML to be written directly into the page’s Document Object Model (DOM) via the error= URL parameter. This can lead to potential cross-site scripting (XSS) attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8319

Affected Products

Bma

References · 8

• 🔥 https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with-keylogger-injection-via-the-error-parameter-in-barracuda-mail-archiver · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8319 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8319 · Vendor Advisory
• https://runzero.com/blog/barracuda-networks · Reddit Post
• https://twitter.com/marcin_brz81183/status/1950404970282364942 · Twitter Post
• https://t.me/CVEtracker/28720 · Telegram Post
• https://twitter.com/CVEnew/status/1950344013640499371 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950392431880343787 · Twitter Post