The vulnerability CVE-2025-39515 affects tnomi Attendance Manager (<= 0.6.2) and is classified as a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows an attacker with at least limited privileges and requiring user interaction to inject malicious scripts that execute in the context of other users. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation information is provided in the available data.

Successful exploitation of this stored XSS vulnerability can lead to limited compromise of confidentiality, integrity, and availability of the affected system or user data. Attackers may execute arbitrary scripts in users' browsers, potentially leading to session hijacking, data manipulation, or denial of service. However, the impact is rated medium severity with low-level impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, applying strict input validation and output encoding on user-supplied data within the application may help mitigate the risk. Additionally, limiting user privileges and educating users about the risks of interacting with untrusted content can reduce exposure.