What’s Vulnerable › Vulnerabilities

CVE-2023-5378: Stored XSS in SmodBIP and MegaBIP

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-29 · updated 2026-06-17
• Weakness: CWE-79

Description

Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.

Affected products

• Jan Syski MegaBIP: through 4.36.2
• Jan Syski SmodBIP: through 2.21

References

• https://cert.pl/en/posts/2023/12/CVE-2023-5378
• https://cert.pl/posts/2023/12/CVE-2023-5378
• https://megabip.pl/
• https://smod.pl/
• https://cert.pl/en/posts/2023/12/CVE-2023-5378
• https://cert.pl/posts/2023/12/CVE-2023-5378
• https://megabip.pl/
• https://smod.pl/

Get alerted when CVE-2023-5378 or the next vulnerability affects your stack