CVE-2025-50581 identifies a cross-site scripting (XSS) vulnerability in MRCMS v3.1.2 specifically via the /admin/group/save.do endpoint. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 4.8, indicating a medium severity. The attack vector is network-based, requiring high privileges and user interaction, and it affects confidentiality and integrity with no impact on availability. There is no information about an available patch or vendor advisory, and no known exploits in the wild have been reported.

Exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts via the vulnerable component, potentially leading to partial disclosure of sensitive information and modification of data within the affected application context. There is no reported impact on system availability. The vulnerability requires user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component to trusted users only and consider applying web application firewall (WAF) rules to detect and block potential XSS payloads targeting /admin/group/save.do. Avoid executing untrusted scripts and validate or sanitize inputs where possible.