This vulnerability (CVE-2025-0419) affects Zirve Nova software versions 235 through 20250131 and is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-Site Scripting (XSS). The CVSS 3.1 base score is 4.7 (medium), with attack vector network, low attack complexity, requiring high privileges, no user interaction, unchanged scope, and impacts on confidentiality, integrity, and availability at a low level. The vulnerability allows an attacker with high privileges to inject malicious scripts into web pages generated by the application. No patch or official fix has been documented, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires high privileges and no user interaction, which limits the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor vendor communications for updates. Given the requirement for high privileges to exploit, restricting access to trusted users and reviewing input handling in affected versions may reduce risk until a fix is available.