CVE-2025-7761

CVSS

No CVSS.

epszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable.

References

Link	Resource
https://cert.pl/posts/2025/07/CVE-2025-7761
https://www.lepszybip.pl/
https://www.lepszybip.pl/

Configurations

No configuration.

History

14 Aug 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-14 10:15

Updated : 2025-08-14 15:15

NVD link : CVE-2025-7761

Mitre link : CVE-2025-7761

CVE.ORG link : CVE-2025-7761

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-7761", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-14T10:15:29.300", "references": [{"url": "https://cert.pl/posts/2025/07/CVE-2025-7761", "source": "[email protected]"}, {"url": "https://www.lepszybip.pl/", "source": "[email protected]"}, {"url": "https://www.lepszybip.pl/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in\u00a0index.php\u00a0form in one of the parameters\u00a0allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.\n\nThe vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable."}, {"lang": "es", "value": "Lepszy BIP es vulnerable a ataques de Cross-Site Scripting (XSS) reflejado. La validaci\u00f3n incorrecta de la entrada en el formato index.php en uno de los par\u00e1metros permite la ejecuci\u00f3n de JavaScript arbitrario en el navegador de la v\u00edctima al abrir una URL especialmente manipulada. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta revelaci\u00f3n, pero no respondi\u00f3. Potencialmente, todas las versiones son vulnerables."}], "lastModified": "2025-08-14T15:15:42.117", "sourceIdentifier": "[email protected]"}

CVE-2025-7761

JSON object

Attach tags to CVE-2025-7761

Attach tags to `CVE-2025-7761`