This vulnerability (CVE-2025-10467) is a stored Cross-site Scripting (CWE-79) issue in PROLIZ Computer Software Hardware Service Trade Ltd. Co.'s OBS (Student Affairs Information System) versions before 25.0401. It results from improper input neutralization during web page generation, enabling attackers to inject and store malicious scripts that execute when viewed by other users. The CVSS 3.1 score is 8.9 (high), reflecting network attack vector, low attack complexity, low privileges required, requirement for user interaction, scope change, and high impact on confidentiality and integrity with low impact on availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially compromising sensitive information (confidentiality) and altering data or application behavior (integrity). The availability impact is low. The vulnerability requires an attacker with low privileges and user interaction to trigger the exploit. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider applying input validation and output encoding controls to mitigate stored XSS risks. Monitor vendor channels for updates and apply the update to version 25.0401 or later once released.