CVE-2025-31589 describes a stored cross-site scripting vulnerability in the Kibru Demeke Ethiopian Calendar application (versions up to 1.1.1). The issue is due to improper input neutralization during web page generation, which can allow an attacker to inject and store malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently provided, and no known exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 6.5 reflects a medium severity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor for vendor updates. Applying input validation and output encoding on user-supplied data in the application code may help mitigate the risk until an official fix is released.