PT-2025-17651 · Q4 · Q4 Inc Investor Relations Platform

K4Nt0R + 1 · Published 2025-04-23 · Updated 2025-04-23 · CVE-2025-29526

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Q4 Inc Investor Relations Platform version 5.147.1.2

Description A Cross-Site Scripting (XSS) issue in the search function allows attackers to execute arbitrary Javascript by injecting a crafted payload into the SearchTerm parameter. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the platform.

Recommendations For Q4 Inc Investor Relations Platform version 5.147.1.2, consider restricting access to the search function until a patch is available, and avoid using the SearchTerm parameter in the affected search endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-29526

Affected Products

Q4 Inc Investor Relations Platform

References · 5

• 🔥 https://docs.google.com/document/d/15vZXyzddcOv61sFSb3Lf9Dg1rnZ9n3Q6ANoa82jzcNA/edit?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29526 · Security Note
• https://gist.github.com/k4nt0r/6ee5bfe9215cb10a436a03c67cf908fd · Note
• https://t.me/cvetracker/22211 · Telegram Post
• https://twitter.com/CVEnew/status/1915091925423772104 · Twitter Post