PT-2025-30412 · Etq · Etq Reliance

Published 2025-07-22 · Updated 2025-09-08 · CVE-2025-34141

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ETQ Reliance CG (legacy) platform (affected versions not specified)

Description A reflected cross-site scripting (XSS) issue exists within the SQLConverterServlet component. This requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The vulnerable servlet was unnecessarily exposed to authenticated users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2025-34141

Affected Products

Etq Reliance

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-34141 · Security Note
• https://t.me/cvetracker/28374 · Telegram Post
• https://twitter.com/Crowd_Security/status/1965004201391464454 · Twitter Post
• https://etq.com/product-overview · Note
• https://twitter.com/CVEnew/status/1947648598251892826 · Twitter Post
• https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance · Note
• https://etq.com/blog/etq-reliance-security-update · Patch, Vendor Advisory
• https://twitter.com/Crowd_Security/status/1965004208320471509 · Twitter Post
• https://vulncheck.com/advisories/etq-reliance-cg-reflected-xss-in-sqlconverterservlet · Note
• https://twitter.com/pdnuclei_bot/status/1948594073885180016 · Twitter Post
• https://t.me/CVEtracker/28374 · Telegram Post
• https://twitter.com/Crowd_Security/status/1965004198443155715 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1947655772566884795 · Twitter Post