CVE-2025-40704 – OpenAtlas XSS: Unvalidated User Input in “/insert/edition” “/name” Parameter

CVE ID : CVE-2025-40704

Published : 29. August 2025 12:15 | 33 Minuten ago

Description : Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the “/insert/edition” petition, “name” parameter.

Severity: 5.1 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…