This vulnerability, identified as CVE-2025-68876, affects INVELITY Invelity SPS connect (versions up to 1.0.8) and involves improper neutralization of input during web page generation, resulting in a reflected Cross-site Scripting (XSS) flaw. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. There is no vendor advisory or patch information available at this time.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser session when they visit a crafted URL. This may lead to limited disclosure of information, manipulation of web content, or disruption of service within the affected application. The CVSS vector indicates partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs or links related to Invelity SPS connect. No official mitigation or temporary fix has been published.