{"id":"CVE-2025-1337","state":"PUBLISHED","title":"Eastnets PaymentSafe BIC Search cross site scripting","description":"A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.5.27.0 is able to address this issue.","publishedAt":"2025-02-16T10:31:05.198Z","updatedAt":"2025-04-09T12:06:21.874Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Eastnets PaymentSafe"],"affected":[{"vendor":"Eastnets","product":"PaymentSafe","versions":[{"version":"2.5.26.0","status":"affected"}],"modules":["BIC Search"]}],"references":["https://vuldb.com/?id.295953","https://vuldb.com/?ctiid.295953","https://vuldb.com/?submit.493686","https://drive.google.com/file/d/1uTRLoCnOGcXtSpoZO8xyPakhIO4MbCMk/view?usp=sharing"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1337.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1337","state":"PUBLISHED","datePublished":"2025-02-16T10:31:05.198Z","dateUpdated":"2025-04-09T12:06:21.874Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-02-15T14:38:53.172Z"},"containers":{"cna":{"title":"Eastnets PaymentSafe BIC Search cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.5.27.0 is able to address this issue."},{"lang":"de","value":"Es wurde eine Schwachstelle in Eastnets PaymentSafe 2.5.26.0 ausgemacht. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Komponente BIC Search. Durch das Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Ein Aktualisieren auf die Version 2.5.27.0 vermag dieses Problem zu lösen."}],"affected":[{"vendor":"Eastnets","product":"PaymentSafe","versions":[{"version":"2.5.26.0","status":"affected"}],"modules":["BIC Search"]}],"references":[{"url":"https://vuldb.com/?id.295953","name":"VDB-295953 | Eastnets PaymentSafe BIC Search cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.295953","name":"VDB-295953 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.493686","name":"Submit #493686 | Eastnets PaymentSafe 2.5.26.0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://drive.google.com/file/d/1uTRLoCnOGcXtSpoZO8xyPakhIO4MbCMk/view?usp=sharing","tags":["broken-link"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-04-09T12:06:21.874Z"},"timeline":[{"time":"2025-02-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-02-15T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-04-09T14:10:29.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"kushkira (VulDB User)","type":"reporter"},{"lang":"en","value":"majd (VulDB User)","type":"analyst"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-18T16:11:12.825500Z","id":"CVE-2025-1337","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-18T16:11:21.914Z"}}]}}}