CVE-2025-32604 is a reflected Cross-site Scripting (XSS) vulnerability in Sajjad Aslani AWSA Shipping (awsa-shipping) affecting versions up to 1.3.0. The issue is due to improper neutralization of input during web page generation, which can allow attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is remotely exploitable without privileges but requires user interaction. The product is a cloud-hosted service, and the vendor is responsible for patching and remediation.

Successful exploitation of this vulnerability could lead to partial compromise of confidentiality, integrity, and availability of the affected system through reflected XSS attacks. This may allow attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, information disclosure, or other malicious actions. However, no known exploits are reported in the wild at this time.

Since the affected product is a cloud service, the vendor manages remediation and typically applies patches server-side. A patch is available for this vulnerability. Users should verify with the vendor advisory for the current patch status and ensure their service instance is updated accordingly. No additional user action is required if the vendor has already applied the fix.