CVEs-PoC/2025/CVE-2025-8319.md

CVE-2025-8319

Description

the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter

POC

Reference

• https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with-keylogger-injection-via-the-error-parameter-in-barracuda-mail-archiver

Github

• https://github.com/AnthonyF445/Pasta-Lab
• https://github.com/fkie-cad/nvd-json-data-feeds