This vulnerability (CVE-2025-11956) in Proliz Software Ltd. Co.'s OBS (Student Affairs Information System) is classified as CWE-79, indicating improper neutralization of input during web page generation resulting in stored cross-site scripting (XSS). It affects versions prior to 25.0401. The CVSS 3.1 base score is 8.9, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with scope changed. Successful exploitation can lead to high confidentiality and integrity impact and low availability impact.

Exploitation of this stored XSS vulnerability can allow an attacker with limited privileges to inject malicious scripts that execute in the context of other users, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of users. The confidentiality and integrity impacts are high, while availability impact is low. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges and educate users to avoid interacting with suspicious content. Monitor vendor communications for updates regarding patches or official mitigations.