This vulnerability (CVE-2025-2610) in MagnusSolution MagnusBilling involves improper neutralization of input during web page generation, specifically in the Alarm Module's protected/components/MagnusLog.Php file. It allows an authenticated attacker to inject stored cross-site scripting payloads. The CVSS 3.1 score is 7.6 (high), reflecting network attack vector, low attack complexity, required privileges, user interaction, and a scope change with high confidentiality impact and low integrity impact. The vulnerability affects MagnusBilling versions through 7.3.0. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows an authenticated user to store malicious scripts that execute in the context of other users' browsers, potentially leading to confidentiality breaches and partial integrity loss of data displayed or processed by the web application. Availability is not impacted. The vulnerability requires authentication and user interaction, limiting but not eliminating risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted users only and consider additional input validation or output encoding controls on affected components if feasible.