Skip to content
OpenAdvisories
Medium · 5.1 CVE-2025-40616 EUVD-2025-12643GHSA-c47v-4q6r-838w

Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy

Published Apr 29, 2025 · Updated Apr 29, 2025 · Assigned by INCIBE

Description

Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php.

Affected products

VendorProductAffectedFixed
Bookgy Bookgy all versions —

References