This vulnerability (CVE-2025-8461) in Seres Software syWEB is a reflected Cross-site Scripting (CWE-79) flaw caused by improper input neutralization during web page generation. An attacker can craft malicious input that is reflected in the web response, potentially executing arbitrary scripts in the context of the victim's browser. The issue affects syWEB versions through 03022026. The vendor has not provided any response or patch information. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, with low confidentiality and integrity impact but high availability impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure, session hijacking, or denial of service affecting availability. The CVSS score of 7.6 reflects a high severity with notable impact on availability and some impact on confidentiality and integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches are available, users should consider applying web application firewalls or input validation controls as temporary mitigations. Monitor official channels for updates from Seres Software regarding patches or official fixes.