A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The vulnerability is in the sle_sSenha parameter of the loginAlterarSenha.asp file. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser within the application's security context. This could enable session cookie theft, sensitive information disclosure, unauthorized actions, or phishing attacks.