CVE-2025-8319
MEDIUMBarracuda Message Archiver Firmware - DOM-Based Cross-Site Scripting via Login Error Parameter
Title source: llmDescription
the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter
References (1)
Core 1
Core References
Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with-keylogger-injection-via-the-error-parameter-in-barracuda-mail-archiver
Scores
CVSS v3
6.1
EPSS
0.0025
EPSS Percentile
16.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
barracuda/message_archiver_firmware
5.4.2.002
Published
Jul 30, 2025
Tracked Since
Feb 18, 2026