CVE-2025-2609: magnussolution magnusbilling

csirt@kutim:~/threat-intel/cve/CVE-2025-2609

CVSS 6.1 · Medium EPSS 1,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada magnussolution magnusbilling. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

Rincian

Terbit di NVD: 21 Maret 2025
Terakhir diubah: 28 Agustus 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 65,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
magnussolution	magnusbilling	Semua versi hingga 7.3.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://chocapikk.com/posts/2025/magnusbilling/ exploit · advisory pihak ketiga
https://vulncheck.com/advisories/magnusbilling-logs-xss advisory pihak ketiga
https://github.com/magnussolution/magnusbilling/commit/f0f083c76157e31149ae58342342fb1bf1629e22

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.