This vulnerability (CVE-2025-0877) in AtaksAPP Reservation Management System is caused by improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). It affects versions before 4.2.3 and allows attackers with high privileges to inject malicious scripts without user interaction. The CVSS 3.1 base score is 4.7, reflecting medium severity with network attack vector, low attack complexity, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation level has been published as of the data provided.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of the application, potentially leading to limited confidentiality, integrity, and availability impacts. However, the attack requires high privileges and does not involve user interaction, which limits the scope and ease of exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to trusted users and applying input validation or web application firewalls where possible may help mitigate risk.