This vulnerability in SecureSubmit Heartland Management Terminal (<= 1.3.0) is due to improper neutralization of input during web page generation, resulting in a reflected cross-site scripting (XSS) flaw. An attacker can craft malicious input that, when reflected in the web interface, executes arbitrary scripts in the victim's browser. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2025-23520, but no vendor patch or official remediation level is currently documented.

Successful exploitation of this reflected XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected user's browser session. This may lead to partial compromise of confidentiality, integrity, and availability of the user's interaction with the Heartland Management Terminal web interface. However, no known exploits are reported in the wild, and the impact is limited to the scope of the web application session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input in the Heartland Management Terminal interface. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary mitigation. Monitor vendor channels for updates on patches or official mitigations.