This vulnerability (CVE-2025-6397) involves improper neutralization of input in Ankara Hosting Website Design Website Software, leading to reflected XSS attacks. An attacker can inject malicious scripts that execute in the context of the victim's browser, potentially leading to data theft, session hijacking, or denial of service. The affected product versions include all up to 03022026. The vendor has not provided a response or patch, and no known exploits are reported in the wild. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with impacts on confidentiality (low), integrity (low), and availability (high).

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially compromising user data confidentiality and integrity, and causing denial of service to the affected web application. The high CVSS score reflects the potential for significant impact on availability as well as confidentiality and integrity.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Organizations using this software should consider implementing web application firewalls (WAFs) with XSS filtering rules as a temporary mitigation. Monitor for suspicious input and avoid using the affected software in high-risk environments until a vendor fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.