The vulnerability CVE-2025-28933 affects maxfoundry MaxA/B (versions <= 2.2.2) and involves a Cross-Site Request Forgery (CSRF) flaw that enables Stored Cross-Site Scripting (XSS). This means an attacker can trick a user into submitting unauthorized requests that lead to malicious scripts being stored and executed in the context of the application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation can lead to stored XSS, allowing attackers to execute malicious scripts in the context of affected users, potentially compromising user data and session integrity. The CSRF aspect means attackers can induce users to perform unintended actions, increasing the risk of unauthorized changes or data manipulation. The overall impact affects confidentiality, integrity, and availability at a low to moderate level as per the CVSS vector.

No patch or official remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and input sanitization to mitigate the risk of stored XSS. Monitor vendor communications for updates on patches or official fixes.