The vulnerability CVE-2025-32673 affects epeken Epeken All Kurir versions up to 2.0.6 and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). This means an attacker could trick an authenticated user into submitting unauthorized requests, potentially resulting in persistent malicious scripts being stored and executed within the application context. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker to execute unauthorized actions as an authenticated user and inject stored malicious scripts, potentially compromising user data confidentiality, integrity, and availability. The combined CSRF and stored XSS impact could facilitate session hijacking, data manipulation, or other malicious activities within the affected application environment. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate stored XSS risks. Monitor vendor communications for updates regarding patches or official mitigations.