This vulnerability involves improper neutralization of input during web page generation (CWE-79), leading to reflected XSS in the SQLConverterServlet of ETQ Reliance CG (legacy). An attacker can craft a malicious URL that, when clicked by an authenticated user, causes execution of unauthorized scripts in the user's browser context. The servlet was unnecessarily exposed, increasing the attack surface. The vendor has disabled the vulnerable servlet in version SE.2025.1, effectively mitigating the issue in that release. No direct patch or fix is linked for earlier versions, and no cloud service remediation applies.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an authenticated user's browser session, potentially leading to session hijacking, unauthorized actions, or information disclosure within the affected application. However, exploitation requires user interaction and authentication. There are no known exploits in the wild at this time.

The vulnerability has been mitigated by disabling the vulnerable SQLConverterServlet in ETQ Reliance CG version SE.2025.1. Users of earlier versions should upgrade to this or a later version where the servlet is disabled. Since no official patch links are provided, upgrading or disabling the affected component manually is recommended. Monitor vendor advisories for any future patches or guidance.