CVE-2025-11183

MediumCVSS 6.9

Published: 13/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

Cross-site scripting vulnerability in the attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.

Risk Assessment

An attacker could execute malicious script in a victim's browser, potentially leading to data theft or session hijacking.

Recommendation

Update QGIS QWC2 to version 2025.08.14 or later, which contains the fix.

Other vulnerabilities in QGIS QWC2

CVE-2025-11184Medium
Cross-site scripting vulnerability in the QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page.

Original NVD description (English source)

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page

Vulnerability data from NVD (NIST) · CISA KEV · EPSS