The vulnerability CVE-2025-67984 affects calliko NPS computy versions up to 2.8.2 and is classified as a DOM-based Cross-site Scripting (XSS) flaw. It arises from improper neutralization of input during web page generation, which can lead to script injection and execution in the user's browser. The CVSS 3.1 vector indicates that the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. The impact includes potential confidentiality, integrity, and availability losses. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability. However, exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying any available temporary mitigations recommended by the vendor once published.