This vulnerability (CVE-2025-10876) in Talent Software e-BAP Automation (versions from 1.8.96 before v.41815) is classified as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). It allows remote attackers to inject malicious scripts into web pages generated by the application, potentially leading to the execution of arbitrary scripts in the context of the affected web application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without authentication or user interaction, but the impact is limited to low confidentiality impact with no integrity or availability impact.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to limited confidentiality impact such as theft of non-sensitive information accessible to the browser. There is no reported impact on integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently referenced, users of affected versions should monitor Talent Software's advisories for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible to mitigate XSS risks specific to this application.