CVE-2025-60916
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
Risk Assessment
An attacker could hijack a user's session, steal credentials, or perform actions on behalf of the victim. This requires luring the user into clicking a crafted link.
Recommendation
Update Openatlas to v8.12.0 or later. Additionally, implement output encoding and validation for the charge parameter.
Other vulnerabilities in Openatlas
See all- CVE-2025-60917Medium
A reflected cross-site scripting (XSS) vulnerability exists in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0. Attackers can inject a crafted payload into the color parameter to execute arbitrary code in the user's browser.
- CVE-2025-60915High
An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
- CVE-2025-60914Medium
Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information by sending a crafted GET request to the /display_logo endpoint.
- CVE-2025-56423Medium
An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via login error messages.
- CVE-2025-40709Medium
A cross-site scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 due to inadequate validation of user input when a POST request is sent. A remote user can send specially crafted queries to an authenticated user via the "/insert/person/<ID>" petition, "name" and "alias-0" parameters, potentially stealing session cookie details.
- CVE-2025-40708Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/event" request to steal session cookie details of an authenticated user.
- CVE-2025-40707Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" and "alias-0" parameters in the "/insert/place" request to steal session cookie details of an authenticated user.
- CVE-2025-40706Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/source" request to steal session cookie details of an authenticated user.
- CVE-2025-40705Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/acquisition" request to steal session cookie details of an authenticated user.
- CVE-2025-40704Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/edition" request to steal session cookie details of an authenticated user.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS