CVE-2025-2406 is an XSS vulnerability (CWE-79) in the Trizbi product by Verisay Communication and Information Technology Industry and Trade Ltd. Co. It results from improper input neutralization during web page generation, enabling injection of malicious scripts. This affects versions prior to 2.144.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and no user interaction, with impact on confidentiality (low), integrity (high), and availability (low). No patch or vendor advisory information is available to confirm remediation status.

Successful exploitation could allow an attacker with low privileges to inject malicious scripts into web pages generated by the affected Trizbi versions, potentially leading to high integrity impact (e.g., unauthorized actions or data manipulation), low confidentiality impact, and low availability impact. This could compromise the trustworthiness of the web application and affect users interacting with it. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible within the application environment.