This vulnerability (CVE-2025-30858) affects Tribulant Software Snow Storm (<= 1.4.6) and involves improper neutralization of input during web page generation, leading to reflected Cross-site Scripting (XSS). The CVSS 3.1 base score is 7.1 (High), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low to low respectively. The vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's browser when they interact with a crafted link or input.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data due to reflected XSS. This may allow attackers to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if feasible. Avoid clicking on suspicious links that may trigger reflected XSS. Monitor vendor communications for patch availability.