Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-40685 State: PUBLISHED Published: 2025-07-29T12:12:44.243Z Last Updated: 2025-07-29T13:03:09.159Z Vendors: Human Resource Management System Products: Human Resource Management System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searcstate' parameter in/state.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE ID: CVE-2025-40686 State: PUBLISHED Published: 2025-07-29T12:12:58.888Z Last Updated: 2025-07-29T13:28:20.853Z Vendors: Human Resource Management System Products: Human Resource Management System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'employeeid' parameter in/detailview.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE ID: CVE-2025-40687 State: PUBLISHED Published: 2025-09-11T11:15:30.359Z Last Updated: 2025-09-11T14:35:56.136Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-89 Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'mobilenumber', 'teamleadname' and 'teammember' parameters in the endpoint '/ofrs/admin/add-team.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40689 State: PUBLISHED Published: 2025-09-11T11:21:04.508Z Last Updated: 2025-09-11T14:35:47.496Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-89 Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'remark', 'status' and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40690 State: PUBLISHED Published: 2025-09-11T11:23:32.365Z Last Updated: 2025-09-11T14:35:41.784Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-89 Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40691 State: PUBLISHED Published: 2025-09-11T11:25:36.321Z Last Updated: 2025-09-11T14:35:35.308Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-89 Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40692 State: PUBLISHED Published: 2025-09-11T11:27:28.569Z Last Updated: 2025-09-11T14:35:27.624Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-89 Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'requestid' parameter in the endpoint '/ofrs/details.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40693 State: PUBLISHED Published: 2025-09-11T11:36:38.826Z Last Updated: 2025-09-11T14:35:14.678Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-79 Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname' parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details. Additional Analyst
user to send a specially crafted query to an authenticated user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40694 State: PUBLISHED Published: 2025-09-11T11:40:56.019Z Last Updated: 2025-09-11T14:35:08.042Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-79 Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
cated user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40695 State: PUBLISHED Published: 2025-09-11T11:46:39.872Z Last Updated: 2025-09-11T14:34:58.730Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-79 Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
thenticated user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40696 State: PUBLISHED Published: 2025-09-11T11:49:52.609Z Last Updated: 2025-09-11T14:34:53.133Z Vendors: PHPGurukul Products: Online Fire Reporting System Problem Types: CWE-79 Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fullname', 'location' and 'message' parameters via POST at the endpoint '/ofrs/reporting.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
user and steal its cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE ID: CVE-2025-40698 State: PUBLISHED Published: 2025-09-25T11:15:38.873Z Last Updated: 2025-09-25T13:12:10.920Z Vendors: Nedatec Consulting Products: Prevengos Problem Types: CWE-89 Description: SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in “/servicios/autorizaciones.asmx/mfsRecuperarListado”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-prevengos-nedatec-consulting
CVE ID: CVE-2025-40702 State: PUBLISHED Published: 2025-08-29T11:16:32.480Z Last Updated: 2025-08-29T11:42:45.694Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/file" petition, "creator" and "license_holder" parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.i
creator" and "license_holder" parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch - https://github.com/craws/OpenAtlas
CVE ID: CVE-2025-40703 State: PUBLISHED Published: 2025-08-29T11:16:53.723Z Last Updated: 2025-08-29T11:42:02.959Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/group" petition, "name" and "alias-0” parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/
"name" and "alias-0” parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch - https://github.com/craws/OpenAtlas
CVE ID: CVE-2025-40704 State: PUBLISHED Published: 2025-08-29T11:17:06.661Z Last Updated: 2025-08-29T11:32:57.751Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/edition" petition, "name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cer
, "name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch - https://github.com/craws/OpenAtlas
CVE ID: CVE-2025-40705 State: PUBLISHED Published: 2025-08-29T11:17:17.539Z Last Updated: 2025-08-29T11:32:22.619Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/acquisition" petition, "name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe
tion, "name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch - https://github.com/craws/OpenAtlas
CVE ID: CVE-2025-40706 State: PUBLISHED Published: 2025-08-29T11:17:27.929Z Last Updated: 2025-08-29T11:30:59.164Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/source" petition, "name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert
"name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch - https://github.com/craws/OpenAtlas
CVE ID: CVE-2025-40707 State: PUBLISHED Published: 2025-08-29T11:17:41.267Z Last Updated: 2025-08-29T11:30:28.087Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/place" petition, "name" and "alias-0” parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/
CVE ID: CVE-2025-40708 State: PUBLISHED Published: 2025-08-29T11:18:03.432Z Last Updated: 2025-08-29T13:44:55.517Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/event" petition, "name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/
CVE ID: CVE-2025-40709 State: PUBLISHED Published: 2025-08-29T11:18:17.870Z Last Updated: 2025-08-29T11:50:38.804Z Vendors: ACDH-CH Products: OpenAtlas Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/person/<ID>” petition, "name" and "alias-0” parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inci
tion, "name" and "alias-0” parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch - https://github.com/craws/OpenAtlas
CVE ID: CVE-2025-40710 State: PUBLISHED Published: 2025-06-30T10:37:05.241Z Last Updated: 2025-06-30T11:15:43.105Z Vendors: Hotspot Shield Products: Hotspot Shield VPN client Problem Types: CWE-74 Description: Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Host header, can cause the VPN client to redirect or forward HTTP requests to servers other than those originally intended, leading to consequences such as open redirects or delivery of traffic
s to servers other than those originally intended, leading to consequences such as open redirects or delivery of traffic to infrastructure controlled by an attacker. This does not imply a flaw in the target applications, but in how the VPN client internally handles outgoing headers and requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/host-header-injection-hhi-hotspot-shield-vpn-client
CVE ID: CVE-2025-40711 State: PUBLISHED Published: 2025-07-08T11:33:15.989Z Last Updated: 2025-07-10T10:12:39.651Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/VerFacturaPDF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40712 State: PUBLISHED Published: 2025-07-08T11:33:40.855Z Last Updated: 2025-08-07T16:06:16.567Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/DescargarFactura. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40713 State: PUBLISHED Published: 2025-07-08T11:35:31.949Z Last Updated: 2025-07-10T10:13:05.162Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo parameter in/<Client>FacturaE/BusquedasFacturasSesion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40714 State: PUBLISHED Published: 2025-07-08T11:35:53.981Z Last Updated: 2025-07-10T10:13:15.911Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo id_factura in /<Client>FacturaE/listado_facturas_ficha.jsp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40715 State: PUBLISHED Published: 2025-07-08T11:36:14.555Z Last Updated: 2025-07-10T10:13:26.518Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo mensaje in /QISClient/api/v1/sucesospaginas. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40716 State: PUBLISHED Published: 2025-07-08T11:36:53.133Z Last Updated: 2025-07-10T10:13:38.804Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the suceso.contenido mensaje in /QMSCliente/Sucesos.action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40717 State: PUBLISHED Published: 2025-07-08T11:37:27.940Z Last Updated: 2025-07-10T10:13:50.178Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-89 Description: SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pagina.filter.categoria mensaje in /QuiterGatewayWeb/api/v1/sucesospagina. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40718 State: PUBLISHED Published: 2025-07-08T11:41:04.457Z Last Updated: 2025-07-10T10:14:05.465Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-209 Description: Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40719 State: PUBLISHED Published: 2025-07-08T11:42:48.980Z Last Updated: 2025-07-10T10:14:17.091Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-79 Description: Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL trhough the id_concesion parameter in /<Client>FacturaE/VerFacturaPDF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40720 State: PUBLISHED Published: 2025-07-08T11:43:06.231Z Last Updated: 2025-07-10T10:14:29.087Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-79 Description: Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL trhough the campo parameter in /<Client>FacturaE/VerFacturaPDF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter
CVE ID: CVE-2025-40721 State: PUBLISHED Published: 2025-07-08T11:43:24.662Z Last Updated: 2025-07-10T10:14:39.292Z Vendors: Quiter Products: Quiter Gateway (Java WAR on Apache Tomcat) Problem Types: CWE-79 Description: Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL trhough the id_factura parameter in /<Client>FacturaE/listado_facturas_ficha.jsp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter