This vulnerability, identified as CVE-2025-69140, affects SweetDate Core versions before 1.1.5. It is an unauthenticated cross-site scripting (XSS) flaw due to improper input neutralization during web page generation, allowing attackers to inject malicious scripts. The CVSS 3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in data disclosure, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the application. Since the attack is unauthenticated and remotely exploitable, it poses a significant risk to users and the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls as temporary mitigations to reduce XSS risk. Monitor official SeventhQueen communications for updates and patches.