CVE-2025-60917
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability exists in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0. Attackers can inject a crafted payload into the color parameter to execute arbitrary code in the user's browser.
Risk Assessment
This vulnerability allows session hijacking, disclosure of sensitive information, or unauthorized actions in the victim's browser context. It can be exploited in phishing attacks.
Recommendation
Update Openatlas to version 8.12.0 or later, which properly validates and encodes input in the color parameter. Implement XSS protection mechanisms.
Other vulnerabilities in Openatlas
See all- CVE-2025-60916Medium
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
- CVE-2025-60915High
An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
- CVE-2025-60914Medium
Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information by sending a crafted GET request to the /display_logo endpoint.
- CVE-2025-56423Medium
An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via login error messages.
- CVE-2025-40709Medium
A cross-site scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 due to inadequate validation of user input when a POST request is sent. A remote user can send specially crafted queries to an authenticated user via the "/insert/person/<ID>" petition, "name" and "alias-0" parameters, potentially stealing session cookie details.
- CVE-2025-40708Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/event" request to steal session cookie details of an authenticated user.
- CVE-2025-40707Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" and "alias-0" parameters in the "/insert/place" request to steal session cookie details of an authenticated user.
- CVE-2025-40706Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/source" request to steal session cookie details of an authenticated user.
- CVE-2025-40705Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/acquisition" request to steal session cookie details of an authenticated user.
- CVE-2025-40704Medium
A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/edition" request to steal session cookie details of an authenticated user.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS