CVE-2025-22524 describes a stored cross-site scripting vulnerability in the 'formafzar' software (versions up to 2.0). This vulnerability results from improper input neutralization during web page generation, which allows attackers to inject and store malicious scripts that execute in the context of other users' browsers. The CVSS score of 6.5 reflects a medium severity with potential impacts on confidentiality, integrity, and availability. Exploitation requires network access, low complexity, some privileges, and user interaction. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The CVSS vector indicates low complexity and privileges required, with user interaction necessary. However, no known exploits are reported, and the extent of impact depends on the deployment and usage of the vulnerable software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is available, users should monitor vendor communications for updates. Until a fix is provided, consider limiting access to the affected application and applying any available input validation or web application firewall rules that might mitigate stored XSS risks.