The vulnerability CVE-2026-25353 affects skygroup Nooni before version 1.5.1 and involves improper neutralization of input during web page generation, resulting in reflected cross-site scripting (XSS). This allows attackers to inject malicious scripts that execute when a victim loads a crafted URL or page, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates the attack is network-based, requires no privileges, but requires user interaction, and the scope is changed. No patch or vendor advisory is currently available.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to limited disclosure of information, modification of data, or disruption of service. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability, though exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted links that could trigger reflected XSS. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may provide temporary mitigation.