The vulnerability CVE-2025-25149 affects Danillo Nunes Login-box versions up to 2.0.4. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS score is 7.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels. No patch or vendor advisory is available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed by authenticated users, data exposure, or manipulation, and partial disruption of service. The confidentiality, integrity, and availability impacts are rated low but combined with the attack vector and scope change, the overall severity is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk of stored XSS via CSRF. Monitor for updates from the vendor regarding patches or official mitigations.