CVE-2025-23995 is a reflected cross-site scripting vulnerability classified under CWE-79 in the ta2g Tantyyellow product through version 1.0.0.5. The issue results from improper input neutralization during web page generation, enabling attackers to inject and execute malicious scripts via crafted input. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it can be exploited remotely without privileges but requires user interaction and affects confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor, and no known exploits are currently reported.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The reflected nature means the attack requires a victim to interact with a crafted link or input. The CVSS score of 7.1 reflects a high severity impact but not critical. No known exploits in the wild have been reported so far.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates regarding fixes. In the meantime, applying input validation and output encoding on user-supplied data within the application may help mitigate risk. Since this is a reflected XSS, educating users to avoid clicking suspicious links can reduce exposure. Avoid deploying affected versions in high-risk environments until a fix is released.