This vulnerability (CVE-2025-0546) affects MevzuatTR versions before 12.02.2025 and is characterized by improper input neutralization during web page generation, classified under CWE-79 (XSS) and CWE-1021 (improper restriction of rendered UI layers or frames). The flaw allows attackers with high privileges to conduct phishing, iFrame overlay, clickjacking, and forceful browsing attacks by injecting malicious scripts or manipulating UI layers. The CVSS 3.1 base score is 4.7, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts through phishing, UI manipulation (clickjacking, iFrame overlay), and forced browsing. However, exploitation requires high privileges, reducing the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to trusted users only and monitor for suspicious activity related to UI manipulation. Avoid exposing the vulnerable versions in untrusted environments.