CVE-2025-28890 describes a reflected cross-site scripting vulnerability in puzich Lightview Plus (<= 3.1.3). The issue stems from improper input neutralization during web page generation, enabling attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of user data confidentiality, integrity, and availability. However, no known active exploits have been reported to date.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Users should monitor the vendor's communications for updates and apply any official patches once released. In the meantime, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts if possible.