The vulnerability identified as CVE-2025-4294 in HotelRunner B2B is an instance of CWE-79, where improper neutralization of input during web page generation enables Cross-Site Scripting (XSS). This allows an attacker with network access, low attack complexity, and high privileges, requiring user interaction, to execute scripts that can compromise confidentiality and integrity of the system. The affected version is exactly version 0 of the product, and the vulnerability was published on July 22, 2025. There is no known exploit in the wild and no patch or official remediation guidance has been provided yet.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the affected application, potentially leading to unauthorized disclosure or modification of information. The CVSS vector indicates that the attack requires high privileges and user interaction, and impacts confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, limit exposure by restricting access to trusted users with high privileges and exercising caution with user inputs that may be reflected in web pages.