Unrated severityNVD Advisory· Published Mar 21, 2025· Updated Nov 22, 2025

MagnusBilling Stored Cross-Site Scripting in Login Logs

CVE-2025-2609

Description

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.

Affected products

Magnussolution/Magnusbillingv5
Range: 0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

chocapikk.com/posts/2025/magnusbilling/mitre
github.com/magnussolution/magnusbilling7/commit/f0f083c76157e31149ae58342342fb1bf1629e22mitre
vulncheck.com/advisories/magnusbilling-logs-xssmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000