CVE-2025-34141

MEDIUM EXPLOITED NUCLEI

ETQ Reliance CG (legacy) < SE.2025.1 - Reflected Cross-Site Scripting in SQLConverterServlet

Title source: llm

Exploitation Summary

CVE-2025-34141 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.

Nuclei Templates (1)

ETQ Reliance - Reflected XSS via SQLConverterServlet

MEDIUMVERIFIEDby slcyber,pdresearch

Shodan: html:"ETQ Reliance"

FOFA: body="ETQ Reliance"

References (4)

Core 4

Core References

Various Sources product

https://www.etq.com/product-overview/

Various Sources vendor-advisory patch

https://www.etq.com/blog/etq-reliance-security-update/

Various Sources technical-description

https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/etq-reliance-cg-reflected-xss-in-sqlconverterservlet

Scores

CVSS v4 5.1

EPSS 0.0114

EPSS Percentile 78.9%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

VulnCheck KEV 2025-07-31

CWE

CWE-116 CWE-79

Status published

Products (1)

ETQ/Reliance CG (legacy) < SE.2025.1

Published Jul 22, 2025

Tracked Since Feb 18, 2026