The vulnerability CVE-2025-23499 affects Pascal Casier's Board Election software versions up to 1.0.1. It is a Cross-Site Request Forgery (CSRF) issue that enables an attacker to inject Stored Cross-Site Scripting (XSS) payloads. This combination allows an attacker to trick authenticated users into executing malicious scripts by submitting unauthorized requests on their behalf. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to Stored XSS attacks, which may allow attackers to execute arbitrary scripts in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions. The CSRF aspect means attackers can induce victims to perform unwanted actions without their consent. The combined impact affects confidentiality, integrity, and availability of the affected system.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk. Monitoring vendor channels for updates is recommended.