CVE-2025-40721 Reflected Cross-site Scripting (XSS) vulnerability in Quiter Gateway

What is CVE-2025-40721?

CVE-2025-40721 is a medium-severity vulnerability in Quiter Gateway (Java WAR on Apache Tomcat), published on 8 Jul 2025.

Official description

Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL trhough the id_factura parameter in /<Client>FacturaE/listado_facturas_ficha.jsp.

Weakness: CWE-79

Which versions are affected by CVE-2025-40721?

It affects 1 product.

Products include Quiter Quiter Gateway.

How do I fix CVE-2025-40721?

No fix has been published for CVE-2025-40721 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-40721 being exploited?

There is no known exploitation of CVE-2025-40721 in the wild and no public exploit code.

Other vulnerabilities in Quiter Gateway (Java WAR on Apache Tomcat)

• CVE-2025-40711 SQL injection vulnerability in Quiter Gateway Critical 9.3
• CVE-2025-40712 SQL injection vulnerability in Quiter Gateway Critical 9.3
• CVE-2025-40713 SQL injection vulnerability in Quiter Gateway Critical 9.3
• CVE-2025-40714 SQL injection vulnerability in Quiter Gateway Critical 9.3
• CVE-2025-40715 SQL injection vulnerability in Quiter Gateway Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-42hw-xrm7-jjwr.