Themedy Toolbox versions up to 1.0.16 suffer from a DOM-based cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject and execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could lead to execution of malicious scripts in the context of the affected application, potentially allowing partial disclosure of information, modification of data, and disruption of service. The attack requires user interaction and low privileges, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider applying any available workarounds or temporary mitigations recommended by the vendor once published.