CVE-2025-56423
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via login error messages.
Risk Assessment
An attacker can obtain information about account existence or other sensitive data, facilitating further attacks (e.g., user enumeration). This affects system confidentiality.
Recommendation
Update OpenAtlas to a patched version or modify login error messages to avoid disclosing sensitive information. Implement uniform error messages.
Other vulnerabilities in OpenAtlas
See all- CVE-2025-60917Medium
A reflected cross-site scripting (XSS) vulnerability exists in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0. Attackers can inject a crafted payload into the color parameter to execute arbitrary code in the user's browser.
- CVE-2025-60916Medium
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
- CVE-2025-60915High
An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
- CVE-2025-60914Medium
Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information by sending a crafted GET request to the /display_logo endpoint.
- CVE-2025-40709Medium
A cross-site scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 due to inadequate validation of user input when a POST request is sent. A remote user can send specially crafted queries to an authenticated user via the "/insert/person/<ID>" petition, "name" and "alias-0" parameters, potentially stealing session cookie details.
- CVE-2025-40708Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/event" request to steal session cookie details of an authenticated user.
- CVE-2025-40707Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" and "alias-0" parameters in the "/insert/place" request to steal session cookie details of an authenticated user.
- CVE-2025-40706Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/source" request to steal session cookie details of an authenticated user.
- CVE-2025-40705Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/acquisition" request to steal session cookie details of an authenticated user.
- CVE-2025-40704Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/edition" request to steal session cookie details of an authenticated user.
Original NVD description (English source)
An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via the login error messages
Vulnerability data from NVD (NIST) · CISA KEV · EPSS