This vulnerability (CVE-2025-6060) in DECE Software Geodi is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-Site Scripting (XSS). It affects Geodi versions prior to 9.0.146. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows that the vulnerability can be exploited remotely over the network with low attack complexity, requires low privileges and user interaction, and results in partial confidentiality and integrity impact without availability impact. There is no vendor advisory or patch link available at this time.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure and modification of information. There is no impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that is reflected in web pages and applying web application firewall (WAF) rules to detect and block XSS payloads. Monitor for vendor updates regarding patches or official mitigations.