CVE-2025-2609

MagnusBilling Stored Cross-Site Scripting in Login Logs

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling: through 7.3.0.

Affected

MagnusSolution · MagnusBilling

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 VULNCHECK

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS

1.15% chance of exploitation in the next 30 days, 66th percentile

Nuclei

high · CWE-79

Published

2025-03-21

Updated

2026-08-28

Proof-of-concept exploits (1)

• https://chocapikk.com/posts/2025/magnusbilling/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2609.yaml

Security advisories

• https://chocapikk.com/posts/2025/magnusbilling
• https://vulncheck.com/advisories/magnusbilling-logs-xss

References

• CVE Record
• NVD entry