The vulnerability CVE-2025-23677 affects the DSmidge HTTP to HTTPS link changer by Eyga.net, specifically versions up to 0.2.4. It is a CSRF vulnerability that enables an attacker to execute stored XSS attacks by tricking a user into submitting unauthorized requests. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation can lead to stored XSS, which may allow attackers to execute malicious scripts in the context of the victim's browser, potentially compromising user data and session integrity. The vulnerability affects confidentiality, integrity, and availability at a low to moderate level as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Eyga.net or the DSmidge project. In the meantime, consider implementing CSRF protections such as anti-CSRF tokens and validating user requests to mitigate risk.