The vulnerability CVE-2025-23606 affects sebkay Calendi (versions <= 1.1.1) and is classified as a reflected cross-site scripting (XSS) issue. It occurs due to improper neutralization of input during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. The CVSS v3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The attack requires user interaction and can be launched remotely over the network without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs or links related to sebkay Calendi. Implementing web application firewalls or input validation may provide temporary mitigation but are not guaranteed to fully prevent exploitation.