This vulnerability (CVE-2025-10612) in giSoft Information Technologies City Guide is due to improper input sanitization leading to reflected Cross-site Scripting (CWE-79). An attacker can craft malicious input that is reflected in the web page output without proper encoding or filtering, potentially leading to script execution in the victim's browser. The issue affects versions prior to 1.4.45. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure or manipulation of client-side data. The impact is limited to confidentiality and integrity with no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor for vendor updates addressing this vulnerability. Until a fix is available, consider applying input validation or web application firewall rules to detect and block reflected XSS attempts specific to this product.