Vulnerability · Published Jul 22, 2025 · Assigned by VulnCheck
CVE-2025-34141ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`
Medium 5.1
In plain English
A medium-severity cross-site scripting in Reliance CG (legacy) from ETQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ETQ | Reliance CG (legacy) | 0 – before SE.2025.1 |
Weakness: CWE-79, CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://www.etq.com/product-overview/ product
- https://www.etq.com/blog/etq-reliance-security-update/ vendor-advisory, patch
- https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/ technical-description
- https://www.vulncheck.com/advisories/etq-reliance-cg-reflected-xss-in-sqlconverterservlet third-party-advisory