This vulnerability (CVE-2025-2204) is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in Cross-Site Scripting (XSS). It affects the Tap&Sign product from Tapandsign Technologies Software Inc. The CVSS 3.1 base score is 4.7 (medium severity), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, unchanged scope, and impacts on confidentiality, integrity, and availability at a low level. The vendor has not provided a patch or advisory, and the product is not a cloud service, so remediation is not managed by the vendor server-side.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts into web pages generated by Tap&Sign, potentially leading to limited confidentiality, integrity, and availability impacts. However, the attack complexity is low and no user interaction is required. There are no known exploits in the wild, and the overall impact is assessed as medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should exercise caution with privileged accounts and consider limiting exposure until a fix is released. Monitor official channels for updates from Tapandsign Technologies Software Inc.