EUVD-2025-17504

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental input validation failure where user-supplied data is reflected in HTTP responses without proper HTML/JavaScript encoding or sanitization. In the context of themeton Spare, an application likely used for theme/template management or content delivery, the flaw occurs when user input (via URL parameters, form fields, or HTTP headers) is directly incorporated into dynamically generated HTML responses. The reflected nature (as opposed to stored) means the malicious payload must be delivered through a crafted URL or request, but does not require the payload to be permanently stored in a database. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates the attack is network-accessible with low complexity, requires no authentication, but does require user interaction (clicking a malicious link), and impacts confidentiality, integrity, and availability across scope boundaries.