Reflected XSS Vulnerability in Quiter Gateway by Quiter

CVE-2025-40721

What is CVE-2025-40721?

A reflected cross-site scripting (XSS) vulnerability exists in Quiter Gateway, particularly in versions prior to 4.7.0. This vulnerability can be exploited by attackers to execute arbitrary JavaScript code in a victim's browser. The attack is facilitated by sending a specially crafted URL that includes the malicious payload via the id_factura parameter in the /FacturaE/listado_facturas_ficha.jsp endpoint. Website administrators and users are encouraged to update their systems to the latest version to mitigate the risk.

References