CVE-2025-69151 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting ThemeGoods Grand Car Rental software versions up to and including 3.7. The issue stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The impact includes limited confidentiality, integrity, and availability loss. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing attackers to steal sensitive information, manipulate content, or perform actions on behalf of the user. The CVSS vector indicates partial confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewalls or input validation controls if feasible. Monitor vendor communications for updates on patches or official mitigations.