CVE-2025-25129 describes a reflected cross-site scripting vulnerability in the NotFound Callback Request product (versions up to 1.4). The vulnerability is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that are reflected in the web response. This can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The vulnerability is exploitable remotely without privileges but requires user interaction. No patch or official remediation is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other user-targeted attacks. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability, though exploitation requires user interaction. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewalls or input validation controls to mitigate reflected XSS risks. Monitor vendor communications for updates and apply patches promptly once released.