CVE-2025-46469 describes a stored cross-site scripting vulnerability in Benjamin Buddle's Send From product versions up to 2.2. The issue is caused by improper neutralization of input during web page generation, which allows attackers with high privileges to inject malicious scripts that execute when other users view the affected content. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with limited impact on confidentiality, integrity, and availability. No patch or vendor advisory information is provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject stored malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and elevated privileges, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to input handling in the Send From application. Avoid enabling untrusted users to submit content that is rendered without proper sanitization.