What is CVE-2025-3894?

CVE-2025-3894 is a vulnerability in Jan Syski Megabip, classified under Cross-site Scripting. Published 2025-05-23.

Is CVE-2025-3894 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Jan Syski Megabip

CVE-2025-3894

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. Version 5.20 of MegaBIP fixes this issue.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.

Affected products

Jan Syski Megabip — versions 0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cvd@cert.pl (third-party-advisory)
cvd@cert.pl (vendor-advisory)
cvd@cert.pl (government-resource)

Frequently asked questions

What is CVE-2025-3894?: CVE-2025-3894 is a vulnerability in Jan Syski Megabip, classified under Cross-site Scripting. Published 2025-05-23.
Is CVE-2025-3894 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.