This vulnerability (CVE-2025-2609) in MagnusSolution MagnusBilling is due to improper neutralization of input during web page generation, specifically in the login logging feature. Unauthenticated attackers can store malicious HTML content in the log component, leading to cross-site scripting (CWE-79). The affected component is protected/components/MagnusLog.php. Versions affected include all from 0 up to and including 7.3.0. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary HTML/JavaScript in the context of the affected web application’s log viewing page. This can lead to disclosure of sensitive information (high confidentiality impact) but has limited impact on integrity and no impact on availability. The vulnerability could be used to perform actions such as session hijacking or delivering malicious payloads to users viewing the logs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the log viewing page to trusted users only and consider disabling or limiting the logging feature that accepts user input. Input sanitization or output encoding should be applied to neutralize HTML content in logs. Monitor vendor channels for updates and apply official patches once released.