Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Published Aug 29, 2025
5.1
MEDIUMCVSS 4.0
EPSS 0.22%
Description
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/acquisition" petition, "name" parameter.
Affected products
-
Affected
- 8.9.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
The vulnerabilities have been fixed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH) team in version 8.10.1, available at https://github.com/craws/OpenAtlas .
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26186 Advisory
- https://github.com/craws/OpenAtlas Product
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch Third Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26186 | Advisory | |
| https://github.com/craws/OpenAtlas | Product | |
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch | Third Party Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data