CVE-2025-2610 is a stored cross-site scripting vulnerability (CWE-79) in MagnusSolution MagnusBilling's Alarm Module, affecting versions up to 7.3.0. The vulnerability stems from improper neutralization of input during web page generation in the protected/components/MagnusLog.Php file, allowing authenticated users to inject malicious scripts that are stored and executed when viewed by others. The CVSS 3.1 base score is 7.6, indicating high severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting confidentiality highly, integrity partially, and no impact on availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated user to inject stored malicious scripts into the web interface, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial integrity compromise. The vulnerability does not affect system availability. This could facilitate further attacks such as session hijacking or privilege escalation within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted authenticated users only and consider monitoring for suspicious activity related to the Alarm Module. Avoid exposing the vulnerable functionality to untrusted users.