CVE-2025-11184

MediumCVSS 6.9

Published: 13/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

Cross-site scripting vulnerability in the QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page.

Risk Assessment

An attacker could execute malicious script in a victim's browser, potentially hijacking sessions or stealing data.

Recommendation

Update QGIS QWC2 to a version newer than v2025.03.31 that removes this vulnerability.

Other vulnerabilities in QGIS QWC2

CVE-2025-11183Medium
Cross-site scripting vulnerability in the attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.

Original NVD description (English source)

Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page

Vulnerability data from NVD (NIST) · CISA KEV · EPSS