The vulnerability CVE-2025-23547 affects the shawfactor LH Login Page product, specifically versions up to 2.14. It is a reflected cross-site scripting (XSS) issue caused by improper neutralization of user input during the generation of web pages. This flaw allows an attacker to craft malicious input that, when reflected by the login page, executes arbitrary scripts in the victim's browser. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session. This may lead to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. However, no known exploits are reported in the wild, and the impact is limited to users interacting with the vulnerable login page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or web application firewall rules to detect and block malicious input targeting the login page. Avoid relying on generic mitigations unless specifically recommended by the vendor.