CVE-2025-40705

Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/acquisition" petition, "name" parameter.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - cve-coordination@incibe.es

Published

2025-08-29

Last modified

2026-10-18

Weaknesses

CWE-79

Affected products

• Openatlas (Acdh-ch)
• Openatlas (Craws)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
• https://github.com/craws/OpenAtlas