CVE-2025-46505 describes a stored cross-site scripting vulnerability in the farinspace Peekaboo product, affecting versions up to 1.1. The flaw is due to improper input neutralization during web page generation, which allows attackers to inject and store malicious scripts that execute in the context of other users' browsers. The vulnerability has a CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this stored XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts within the affected Peekaboo application. Attackers may execute malicious scripts in users' browsers, potentially leading to session hijacking, data manipulation, or denial of service within the scope of the affected application. However, the attack requires user interaction and low privileges, and no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules or input sanitization as temporary mitigations. Monitor vendor communications for updates on patches or official fixes.