The vulnerability CVE-2025-31388 affects the doa The World product versions up to 0.4 and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, and requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level but is considered high severity overall. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to trick an authenticated user into submitting unauthorized requests that result in stored XSS payloads. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user data and session integrity. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input sanitization to mitigate stored XSS risks. Avoid interacting with untrusted links or sites that could trigger CSRF attacks.