Reflected XSS Vulnerability in Quiter Gateway by Quiter

CVE-2025-40720

What is CVE-2025-40720?

A reflected XSS vulnerability exists in Quiter Gateway, allowing attackers to execute arbitrary JavaScript code in the session of a legitimate user. This is achieved by crafting a malicious URL that targets the 'campo' parameter in the /FacturaE/VerFacturaPDF endpoint. Users of the application prior to version 4.7.0 are particularly at risk, as the vulnerability exposes them to potential exploits that can compromise their browser security.

References