# CVE-2025-34141: Reliance CG (legacy) - XSS

> Live exploitation tracking for CVE-2025-34141 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34141

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.1
- **Public exploit available:** Yes
- **Affected products:** ETQ Reliance CG (legacy)
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')); CWE-116 (Improper Encoding or Escaping of Output)

## Description

A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.

## CrowdSec analysis

[CVE-2025-34141](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34141) is a reflected cross-site scripting (XSS) vulnerability in the ETQ Reliance CG (legacy) platform's SQLConverterServlet component. By enticing users to click on a specially crafted link, attackers can execute unauthorized scripts in the context of the user's session, potentially leading to information disclosure or session hijacking. This vulnerability was addressed by disabling the affected servlet in version SE.2025.1.

CrowdSec has been tracking this vulnerability and its exploits since 24th of July 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-34141 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-34141. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the `/SQLConverterServlet` endpoint by injecting XSS payloads into the `MySQLStm` parameter, potentially leading to execution of arbitrary scripts in the user's browser session.

## Timeline

- 2025-07-22: CVE Published. CVE-2025-34141 is published to NVD.
- 2025-07-24: Rule Released. CrowdSec releases a rule to detect CVE-2025-34141 exploitation attempts against the CrowdSec Network.
- 2025-07-31: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34141 for the first time.

## References

- https://www.etq.com/product-overview/
- https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/
- https://www.etq.com/blog/etq-reliance-security-update/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34141.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34141) follows observed exploitation activity for CVE-2025-34141. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.