CVE-2025-3894: Jan Syski Megabip

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required.   Version 5.20 of MegaBIP fixes this issue.

Affected products

• Jan Syski Megabip: up to and including 5.19

Published 2025-05-23. Last modified 2026-06-17.