CVE-2025-2404 is an XSS vulnerability classified under CWE-79 affecting Ubit Information Technologies STOYS version 2 prior to 20250916. The vulnerability results from improper input sanitization during web page generation, enabling attackers with low privileges to inject scripts without user interaction. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows an attacker with low privileges to inject malicious scripts into web pages generated by STOYS, potentially leading to integrity issues such as unauthorized script execution. There is no direct impact on confidentiality or availability. No known exploitation in the wild has been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for any forthcoming fixes. Until a patch is released, consider applying web application firewall (WAF) rules to detect and block XSS attempts if feasible. Avoid exposing vulnerable versions to untrusted users where possible.