The vulnerability CVE-2026-25351 affects skygroup's MyMedi product before version 1.7.7. It is a reflected cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This flaw can enable attackers to inject malicious scripts that execute when a user interacts with a crafted URL or input, potentially leading to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session. This may lead to limited confidentiality, integrity, and availability impacts, such as theft of user data, session hijacking, or disruption of service. However, no known exploits have been reported in the wild, and the impact is constrained by the requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Avoid clicking on suspicious links and ensure that input validation and output encoding are applied where possible in the application environment.