craws/OpenAtlas

craws/OpenAtlas

Releases127

Frequency3 weeks 3 days

Last Release 2 months ago

Stars96

OpenAtlas is an open source, web based database system for complex archaeological, historical and prosopographical data.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-40707 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/place" petition, "name" and "alias-0” parameters.
CVE-2025-40708 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/event" petition, "name" parameter.
CVE-2025-40709 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/person/<ID>” petition, "name" and "alias-0” parameters.
CVE-2025-40703 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/group" petition, "name" and "alias-0” parameters.
CVE-2025-40704 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/edition" petition, "name" parameter.
CVE-2025-40705 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/acquisition" petition, "name" parameter.
CVE-2025-40706 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/source" petition, "name" parameter.
CVE-2025-40702 ↗	Aug 29, 2025Friday, 29 August 2025, 12:15	5.4 MEDIUM	—
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via the "/insert/file" petition, "creator" and "license_holder" parameters.