CVE-2025-49898 describes a DOM-based Cross-site Scripting vulnerability (CWE-79) in Xolluteon Dropshix versions through 4.0.14. The issue stems from improper neutralization of input during web page generation, enabling an attacker with high privileges to execute malicious scripts in the context of the affected application. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix information is provided, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted. The attacker must have high privileges to exploit this vulnerability, and no user interaction is required. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict access to high-privilege accounts and monitor for suspicious activity related to script injection. Avoid exposing vulnerable versions publicly if possible.