This vulnerability (CVE-2025-8695) affects Netcad NetGIS Server versions 5.2.4 through 22.08.2025 and is classified as CWE-79: Improper Neutralization of Input During Web Page Generation, resulting in reflected Cross-site Scripting (XSS). An attacker can craft input that is improperly sanitized and reflected in web responses, potentially executing arbitrary scripts in the victim's browser session. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts integrity and availability with no confidentiality impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to limited integrity and availability impacts such as unauthorized actions or denial of service in the affected web application. Confidentiality is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or web application firewall rules to detect and block suspicious input patterns that could trigger reflected XSS. Monitor official Netcad communications for updates on patches or mitigations.