Skip to content
OpenAdvisories
Medium · 5.1 CVE-2025-40615 EUVD-2025-12629GHSA-gxhp-4g3m-x7p8

Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy

Published Apr 29, 2025 · Updated Apr 29, 2025 · Assigned by INCIBE

Description

Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "TEXTO" parameter in /api/api_ajustes.php.

Affected products

VendorProductAffectedFixed
Bookgy Bookgy all versions —

References