The vulnerability CVE-2025-23755 in tosend.it PAFacile (<= 2.6.1) is a Reflected Cross-site Scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute in the context of the victim's browser when they interact with crafted links or inputs. The CVSS score of 7.1 reflects a high-severity issue with potential impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted inputs and links. Since no official patch or workaround is provided, monitoring vendor communications for updates is recommended.