CVE-2025-23735 describes a reflected XSS vulnerability in the Infugrator product by Cosmin Schiopu affecting versions up to 1.0.3. The issue stems from improper input neutralization during web page generation, enabling attackers to inject and execute arbitrary scripts when a user interacts with crafted input. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser session. This may lead to partial disclosure of sensitive information, modification of data, or disruption of service availability. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component. However, there are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewalls or input validation as temporary mitigations specific to reflected XSS. Monitor vendor channels for updates regarding patches or official fixes.