CVE-2025-7761

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2025/07/CVE-2025-7761
https://www.lepszybip.pl/
https://www.lepszybip.pl/

Configurations

No configuration.

History

14 Aug 2025, 15:15

Type	Values Removed	Values Added
References	~~() https://www.lepszybip.pl/ -~~	() https://www.lepszybip.pl/ -

14 Aug 2025, 13:11

Type	Values Removed	Values Added
Summary		(es) Lepszy BIP es vulnerable a ataques de Cross-Site Scripting (XSS) reflejado. La validación incorrecta de la entrada en el formato index.php en uno de los parámetros permite la ejecución de JavaScript arbitrario en el navegador de la víctima al abrir una URL especialmente manipulada. Se contactó al proveedor con antelación para informarle sobre esta revelación, pero no respondió. Potencialmente, todas las versiones son vulnerables.

14 Aug 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-14 10:15

Updated : 2025-08-14 15:15

NVD link : CVE-2025-7761

Mitre link : CVE-2025-7761

CVE.ORG link : CVE-2025-7761

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-7761", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-14T10:15:29.300", "references": [{"url": "https://cert.pl/posts/2025/07/CVE-2025-7761", "source": "cvd@cert.pl"}, {"url": "https://www.lepszybip.pl/", "source": "cvd@cert.pl"}, {"url": "https://www.lepszybip.pl/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in\u00a0index.php\u00a0form in one of the parameters\u00a0allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.\n\nThe vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable."}, {"lang": "es", "value": "Lepszy BIP es vulnerable a ataques de Cross-Site Scripting (XSS) reflejado. La validaci\u00f3n incorrecta de la entrada en el formato index.php en uno de los par\u00e1metros permite la ejecuci\u00f3n de JavaScript arbitrario en el navegador de la v\u00edctima al abrir una URL especialmente manipulada. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta revelaci\u00f3n, pero no respondi\u00f3. Potencialmente, todas las versiones son vulnerables."}], "lastModified": "2025-08-14T15:15:42.117", "sourceIdentifier": "cvd@cert.pl"}