CVE-2025-56289 identifies a Cross Site Scripting (XSS) vulnerability in code-projects Document Management System 1.0. The vulnerability arises from insufficient input sanitization in the Company field during file addition, enabling attackers with limited privileges and requiring user interaction to execute malicious scripts. Successful exploitation can lead to leakage of admin cookie information, impacting confidentiality. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and a scope change with limited confidentiality and integrity impact but no availability impact.

An attacker can exploit this XSS vulnerability to execute malicious scripts in the context of an administrator's session, potentially leaking sensitive cookie information. This compromises confidentiality and integrity of the admin session but does not affect system availability. The attack requires user interaction and low privileges, limiting ease of exploitation.

No patch or official remediation is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the Company field. Avoid entering untrusted data into this field.