This vulnerability (CVE-2025-48360) affects Razvan Stanga's Varnish/Nginx Proxy Caching product up to version 1.8.3. It is caused by improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). The CVSS 3.1 score is 5.9 (medium), with an attack vector of network, low attack complexity, requiring high privileges and user interaction, and a changed security scope. The impact includes limited confidentiality, integrity, and availability loss. No patch or vendor advisory information is currently available to confirm remediation status.

Successful exploitation can result in stored XSS attacks, potentially allowing an attacker to execute malicious scripts in the context of affected users. This can lead to partial compromise of confidentiality, integrity, and availability of the system or data. However, exploitation requires high privileges and user interaction, limiting the ease of attack. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting access to high-privilege users and monitoring for suspicious activity related to input handling in the affected product. Avoid enabling features that process untrusted input in vulnerable versions.