The vulnerability CVE-2025-52750 affects Juergen Schulze Emu2 (emu2-email-users-2) through version 0.83b. It is a reflected Cross-site Scripting (XSS) issue resulting from improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute in users' browsers, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 indicates a high severity with low complexity and no privileges required, but user interaction is necessary. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted links or inputs in affected versions of Emu2. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary mitigation. Monitor vendor channels for updates regarding patches or official fixes.