title: Stored XSS in SmodBIP and MegaBIP
description: Improper Input Validation vulnerability in  MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unknown
product: MegaBIP
repo: https://megabip.pl/pobierz/1
vendor: Jan Syski
versions:
lessThanOrEqual: 4.36.2, status: affected, version: 0, versionType: semver
lessThan: *, status: unaffected, version: 5.08, versionType: semver
}
{
defaultStatus: affected
product: SmodBIP
repo: https://smod.pl/pliki/smodbip221.zip
vendor: Jan Syski
versions:
lessThan: *, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL