Reflected Cross-Site Scripting Vulnerability in Bookgy by Incibe

CVE-2025-40615

What is CVE-2025-40615?

The reflected XSS vulnerability in Bookgy enables attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser. This occurs through the manipulation of the 'TEXTO' parameter in the /api/api_ajustes.php endpoint. By crafting a malicious URL, an attacker can exploit this vulnerability to influence user sessions, potentially leading to unauthorized access or data theft. It is crucial for users to be aware of this risk and apply necessary security measures to safeguard their applications.

References