CVE-2025-46437 describes a reflected cross-site scripting (XSS) vulnerability in Tayori Form by tayoricom affecting versions up to 1.2.9. The issue arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, modification of data, or disruption of service. The reflected nature means the attack requires a user to interact with a crafted link or input. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls at the application level to mitigate reflected XSS risks. Monitor vendor channels for updates and patches.