CVE-2025-64633 describes a basic cross-site scripting (XSS) vulnerability in colabrio Norebro Extra through version 1.6.8. The issue arises from improper neutralization of script-related HTML tags in web pages, enabling an attacker to inject code. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting low impact on confidentiality and no impact on integrity or availability. It can be exploited remotely without authentication or user interaction. No vendor advisory or patch information is provided, and the product is not a cloud service.

The vulnerability allows an attacker to inject script code into web pages served by Norebro Extra, potentially leading to limited confidentiality impact such as information disclosure via script execution in a victim's browser. There is no impact on integrity or availability. Exploitation does not require privileges or user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates regarding patches or official mitigations.