The vulnerability identified as CVE-2025-49292 affects Cozmoslabs Profile Builder versions up to 3.13.8. It stems from improper validation of user-supplied quantity input, which can be exploited to conduct phishing attacks. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impact limited to integrity. No known exploits in the wild have been reported, and no vendor advisory or patch information is currently available.

The impact is limited to integrity, enabling phishing attacks through manipulation of input quantity validation. There is no direct impact on confidentiality or availability. Exploitation requires user interaction and can be performed remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with inputs related to quantity fields in the affected Profile Builder versions and monitor for updates from Cozmoslabs.