This vulnerability, identified as CVE-2025-4763, involves improper neutralization of input in the Hotel Guest Hotspot product by Aida Computer Information Technology Inc., leading to reflected cross-site scripting (CWE-79). An attacker could exploit this flaw by injecting malicious scripts into web pages generated by the affected software, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects versions up to 22012026. The vendor has not provided any response or patch information. The CVSS 3.1 base score is 5.5, with attack vector as adjacent network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability rated low.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated as medium severity with low-level impacts on confidentiality, integrity, and availability. There are no known active exploits in the wild.

No official patch or remediation has been provided by the vendor, and the vendor did not respond to disclosure attempts. Patch status is not yet confirmed — check the vendor advisory or official channels for current remediation guidance. Until a fix is available, users should consider mitigating exposure by restricting access to the affected interface or employing web application firewalls that can detect and block reflected XSS attempts.