CVE-2025-22332 describes a reflected cross-site scripting vulnerability in the shanaver CloudFlare(R) Cache Purge product, versions up to 1.2. The vulnerability is due to improper input neutralization during web page generation, which could allow an attacker to execute arbitrary scripts in the context of a victim's browser. The CVSS score is 7.1 (high severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The product is a cloud service, and a patch is available to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure, modification of data, or disruption of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known exploits in the wild currently.

A patch is available for this vulnerability. Since the affected product is a cloud-hosted service, the vendor is responsible for applying the fix. Users and administrators should verify with the vendor that the service has been updated to the patched version to mitigate this vulnerability.