The vulnerability CVE-2025-28892 affects a2rocklobster FTP Sync versions up to 1.1.6 and is characterized as a Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). The CVSS 3.1 vector indicates it is remotely exploitable over the network without privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. There is no vendor advisory or patch information available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can result in partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Monitoring for suspicious activity related to stored XSS attempts is advisable. Avoid interacting with untrusted links or sites that could trigger CSRF attacks.