CVE-2025-60914
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information by sending a crafted GET request to the /display_logo endpoint.
Risk Assessment
An unauthorized user may access sensitive data, potentially compromising information confidentiality. The risk affects Openatlas instances before version 8.12.0.
Recommendation
Update Openatlas to version 8.12.0 or later. Review access logs for unauthorized requests to /display_logo.
Other vulnerabilities in Openatlas
See all- CVE-2025-60917Medium
A reflected cross-site scripting (XSS) vulnerability exists in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0. Attackers can inject a crafted payload into the color parameter to execute arbitrary code in the user's browser.
- CVE-2025-60916Medium
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
- CVE-2025-60915High
An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
- CVE-2025-56423Medium
An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via login error messages.
- CVE-2025-40709Medium
A cross-site scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 due to inadequate validation of user input when a POST request is sent. A remote user can send specially crafted queries to an authenticated user via the "/insert/person/<ID>" petition, "name" and "alias-0" parameters, potentially stealing session cookie details.
- CVE-2025-40708Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/event" request to steal session cookie details of an authenticated user.
- CVE-2025-40707Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" and "alias-0" parameters in the "/insert/place" request to steal session cookie details of an authenticated user.
- CVE-2025-40706Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/source" request to steal session cookie details of an authenticated user.
- CVE-2025-40705Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/acquisition" request to steal session cookie details of an authenticated user.
- CVE-2025-40704Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/edition" request to steal session cookie details of an authenticated user.
Original NVD description (English source)
Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via sending a crafted GET request to the /display_logo endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS