CVE-2025-23695 describes a reflected Cross-site Scripting (XSS) vulnerability in the kinlane CtyGrid Hyp3rL0cal Search product, specifically in the hyp3rl0cal-city-search component. The vulnerability is due to improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that are reflected back to the user. This affects versions up to and including 0.1.1.1. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in information disclosure, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high impact with user interaction required and no privileges needed by the attacker.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying input validation or output encoding workarounds if possible and exercise caution when interacting with untrusted inputs in the affected product.