CVE-2025-2610

HighCVSS 7.6

Published: 21/03/2025(UTC)Updated: 28/08/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.92%

57th percentile - higher than 57% of all known CVEs

Summary

In MagnusBilling up to version 7.3.0, a stored XSS vulnerability exists in the Alarm module. Improper input neutralization in the file protected/components/MagnusLog.Php allows an authenticated attacker to inject malicious scripts.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their browser, compromising data confidentiality and integrity.

Recommendation

Immediately update MagnusBilling to the latest available version and apply proper input filtering and output encoding in the MagnusLog.Php file.

Other vulnerabilities in MagnusBilling

CVE-2025-2609High
In MagnusBilling up to version 7.3.0, the file protected/components/MagnusLog.php contains a Cross-Site Scripting (XSS) vulnerability. Unauthenticated users can store malicious HTML content in login logs, which is then displayed in the log view component accessible at /mbilling/index.php/logUsers/read.

Original NVD description (English source)

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS