CVE-2025-49336 describes a stored cross-site scripting vulnerability in pondol Pondol BBS (versions up to 1.1.8.4). This vulnerability is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that are stored and later executed in the context of other users' browsers. The CVSS 3.1 base score is 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L), reflecting a medium severity with network attack vector, low attack complexity, requiring high privileges and user interaction, and with partial impact on confidentiality, integrity, and availability. There is no patch or official fix information available in the provided data.

Successful exploitation of this vulnerability could allow an attacker with high privileges and requiring user interaction to execute stored malicious scripts in the browsers of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider implementing additional input validation or output encoding as temporary mitigations. Monitor vendor communications for updates on patches or official fixes.