CVE-2025-34141

ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`

State: Published
Severity: 5.1 Medium
Published: Jul 22, 2025
Updated: May 15, 2026
Reserved: Apr 15, 2025

Description

A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CWE-116 Improper Encoding or Escaping of Output

Affected Products

Product	Versions
Reliance CG (legacy)ETQ	before SE.2025.1Affected

References

https://www.etq.com/product-overview/product
https://www.etq.com/blog/etq-reliance-security-update/vendor-advisorypatch
https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/technical-description
https://www.vulncheck.com/advisories/etq-reliance-cg-reflected-xss-in-sqlconverterservletthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.