This vulnerability (CVE-2025-4411) affects Dataprom Informatics PACS-ACSS and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). It allows an attacker to inject malicious scripts into web pages generated by the affected software. The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with low attack complexity and no required privileges or user interaction, impacting confidentiality and availability with low severity. The issue affects versions prior to 16.05.2025. No patch or official remediation information is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to limited confidentiality loss and low impact on availability. Integrity impact is not indicated. The vulnerability does not require user interaction or privileges, making it accessible remotely over the network. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Dataprom Informatics communications for updates. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block XSS attempts if feasible. Avoid exposing the affected application to untrusted networks where possible.