CVE-2025-58256 describes a stored cross-site scripting vulnerability in Jonathan Brinley DOAJ Export versions up to 1.0.4. The issue is caused by improper input neutralization during web page generation, which allows attackers with high privileges to inject malicious scripts that are stored and later executed in the context of other users. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. This vulnerability can lead to limited confidentiality, integrity, and availability impacts. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium based on the CVSS score and the requirement for user interaction and privileges. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor for updates from the vendor. Until a fix is released, restricting access to trusted users and minimizing exposure of the vulnerable functionality may reduce risk. Avoid granting unnecessary high privileges to users to limit potential exploitation.