Bookgy Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Bookgy, an online booking and management software. This vulnerability allows attackers to execute JavaScript in the context of the victim's browser. The issue arises in the 'TEXTO' parameter of the '/api/api_ajustes.php' endpoint.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

This vulnerability has been fixed by the Bookgy team in October 2024 and is no longer exploitable.